Overview

overview

10

Static

static

3

2026-10-24...ck.exe

windows10-2004-x64

10

2026-10-24...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/10/2026, 04:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
  • Size 1.6MB
  • Sample261025-eymbzagd34
  • SHA256 84666785f90d3bb4b8fa3c3185bb12c62973efce01067e5acb1b1d03413913b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Renames multiple (97) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Users\Admin\nIQQgwco\XUMoAsEI.exe
      "C:\Users\Admin\nIQQgwco\XUMoAsEI.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:4140
    • C:\ProgramData\gikYEcQo\qqQMcYcw.exe
      "C:\ProgramData\gikYEcQo\qqQMcYcw.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:1884
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5188
          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4424
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5296
              • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3772
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4400
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2704
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5936
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1748
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1232
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4908
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5604
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2788
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1704
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:1244
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2160
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5784
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                          20⤵
                                            PID:5768
                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5988
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                22⤵
                                                • Executes a command shell one-liner
                                                PID:5516
                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                  23⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1392
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                    24⤵
                                                    • Executes a command shell one-liner
                                                    PID:6016
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                      25⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2112
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                        26⤵
                                                          PID:4248
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                            27⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4772
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                              28⤵
                                                              • Executes a command shell one-liner
                                                              PID:5356
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                29⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1732
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                  30⤵
                                                                    PID:1856
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                      31⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5376
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                        32⤵
                                                                        • Executes a command shell one-liner
                                                                        PID:3068
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                          33⤵
                                                                            PID:1828
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                              34⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4696
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                35⤵
                                                                                  PID:4388
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                    36⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:4784
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                      37⤵
                                                                                        PID:4916
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                          38⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:5508
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                            39⤵
                                                                                              PID:3280
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                40⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:4320
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                  41⤵
                                                                                                    PID:2024
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                      42⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1968
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                        43⤵
                                                                                                          PID:1300
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                            44⤵
                                                                                                              PID:1868
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                45⤵
                                                                                                                  PID:5480
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                    46⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:92
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                      47⤵
                                                                                                                        PID:4200
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                          48⤵
                                                                                                                            PID:2148
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                              49⤵
                                                                                                                                PID:608
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                  50⤵
                                                                                                                                    PID:4808
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                      51⤵
                                                                                                                                        PID:4800
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                          52⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:3712
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                            53⤵
                                                                                                                                              PID:2956
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                54⤵
                                                                                                                                                  PID:4360
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                    55⤵
                                                                                                                                                      PID:4616
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                        56⤵
                                                                                                                                                          PID:1864
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                            57⤵
                                                                                                                                                              PID:1648
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                58⤵
                                                                                                                                                                  PID:4484
                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    59⤵
                                                                                                                                                                      PID:5332
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                      59⤵
                                                                                                                                                                        PID:4708
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                          60⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:5408
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                            61⤵
                                                                                                                                                                              PID:6048
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                62⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:944
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                  63⤵
                                                                                                                                                                                    PID:4912
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                      64⤵
                                                                                                                                                                                        PID:1956
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                          65⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2444
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                            66⤵
                                                                                                                                                                                              PID:5828
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                67⤵
                                                                                                                                                                                                  PID:2512
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                          PID:4996
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1608
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:4336
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                  PID:200
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                                        PID:6132
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                              PID:5028
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:1116
                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                    PID:4236
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:6100
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                            PID:2560
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:3204
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                  PID:596
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                      PID:3268
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                          PID:1488
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:588
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                    PID:1728
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                        PID:3548
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                            PID:4924
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                                                                                                PID:5044
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:2692
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                      PID:4152
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:3420
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:4072
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                PID:912
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                    PID:2260
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                                                        PID:4564
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:2920
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                              PID:3568
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:2276
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                    PID:2368
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:684
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                          PID:540
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:2120
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                                                                                                                PID:4204
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                                                                                        PID:4332
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                          PID:3704
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                                                                                                              PID:5740
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2172
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4544
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1220
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2540
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:916
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2320
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:364
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1460
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1708
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:940
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4308
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3528
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:984
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:460
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GUUgwEYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:352
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cecYMUYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iWskQIEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fqIUUkcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JCgwYocA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fuMgYcsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZwcoQocE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UIQcwMAE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OcoQAUgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gugoQAUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lQIAYoYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jwUcEwsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LKckgkYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KkEEkUsU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YUwQUosQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YKEQAMks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CGoYIwsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vesgQQgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZKkQsokE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JqoIgwIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xmMAIQwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aEIkwQkk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qSYEcAoI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QKEoIsgM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAsgokYs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JSkkMgAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TAAEUscs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lgAoAkMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kkIwwUUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IesMQAMM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SCkYMEMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OkwscAsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dGIUEoMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZIsUAkMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIgkUQAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JUgooAEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UEUEgcUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uSkEQgcY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qGoQEkQk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nKMAggUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAAoEwso.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FqwwMAYU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OKMEkYwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3836
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      51⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VIAAsUko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:112
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hmwYUAQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                              44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                              44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PacYUgIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  45⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qyMgogwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                43⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAQswgkA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3728
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            41⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gOEcIUkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                          38⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                            39⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VEwQQkgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          37⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zEwcMswQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TqUMEAMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PUoEsQcA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:612
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cgQIgMMU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:260
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mCwYsMYo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oSYIoAUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              25⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\doMUMkAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hmEckAgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nkoYIQgY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SawkwwwI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:596
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SUksoYQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\agcAgkYg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bOYkQAYA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VgogoIIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TiwUIUcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:596
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:608
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DskQQAAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4944
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:3372
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UosgEsEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2644
                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\bWoAgsMw\YcIMoUAI.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\ProgramData\bWoAgsMw\YcIMoUAI.exe
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:5400
                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\gikYEcQo\qqQMcYcw.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\ProgramData\gikYEcQo\qqQMcYcw.exe
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\nIQQgwco\XUMoAsEI.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\nIQQgwco\XUMoAsEI.exe
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:3908

                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                                                                                                                                                                    Visual Basic

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1059.005

                                                                                                                                                                                                                                                                                                                                                                                                    Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1059.003

                                                                                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                    Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1564

                                                                                                                                                                                                                                                                                                                                                                                                    Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1564.001

                                                                                                                                                                                                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                                                                                                                                                                                                    Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1562.001

                                                                                                                                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1555

                                                                                                                                                                                                                                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1614

                                                                                                                                                                                                                                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1016

                                                                                                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                    YcIMoUAI.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\bWoAgsMw\YcIMoUAI.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d534bb23a598df88d9bcd97f364bd6a2e7a80a2a9a03d8a4dfce991992943637
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 67bb9091d8cd93e8d58d1cb70c4c0d4d63e2118d775b8935545238f905cbc277
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 82c37f4140692e3a84c99efb3c09c75d781784a72b3a593c1023e7180fb23b08
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 03245ef2474610e21a1fbe2f564d5ad2a94317a0a3b0ad8dd4555f3453d5ad58
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 edfddc706e6014c8da0bf8bf786587349f12490b441e3240901f04890316c5dc
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5f04ce319c5ed9a273cc6687e85907e832f425ff71c67aee3167e429be673971
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7b20ff28f2d8802a3d87b003e4c5ed4ccb269ed57c5d135ac5b033ff32eca04e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d34ae1cb1e0964f24efd3b05784b0461140b188418ccf446fd6bc6ccd2a9600c
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5ec1bd23b4b690996595e8e04fa76bb367313717c03b28cebb95a76243cd22c4
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ff55582faa845bfd185fdce47055beb79d01f06595477afe838a75e861bd3a19
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 273a1f3a4346d5fc524aa5940c1578450d7c80257b5443e5880a47d302db1685
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 8c959481f40cdb9156f585ca880f81e2444bd929a1b7be8feea4fdcb97026027
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 9e64ebb76a819f67737929bf801fd1a29e799f2dc51ed1daec851b604168a95a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 399b43360485951b837b96614dbade479c84381cc7eec8ba9347aca2da1d9a6e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 9dd00426851584c15cd1d5b58872046c8f4edc45e0cf7ff14ffcb9003a696007
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 615f173eed7ed04a6e1d1dee96dc7bff25e23253fb438b78d615e72213c515c0
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7126837bff5da3cffdd1c51cf917fd308b7e33d72fd0f23cfd9f22c5206e2b17
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 37dfe049661daa171a4d02ef686db82dd74738c7b03ec4a6554482c23804dedf
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6c98d9401119ba22f652c17bd02c203de76c71c15bbeb916154372891af88ca1
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a221df04195c4bbaa5f80953ddf13baef08faeb25eb1d457de31e14813e136ec
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 9e9498866569384195cea5f3fd21b7506806172f485838d5199ff1ed6ee92965
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4d9ca31a81b773625c80e00e6926400fd3a46ddbf7c0103abd5c77bae1e20d1f
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4aa9afafbad6f2083b28a4d90e540b287fce9550f78d366f77fa192ab0995959
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e2eaea9ebd7dc77951b3a4ae06fa875446e6ce1e4faaeada707c6d76abd7c5ea
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 cd109234d59446cd510adc0e13e87397eabeffeb17c3a6a12bdd449c57126d89
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1f1654388ee2387804452ce8005925d1f8eff71a8ff3422f108174e9537bdad0
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 083fe9d8ca5fbcc8c2687c4636650a53f6cd233b5e735e4d0680d5c1348693df
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 947c3f1b84bc9be97356cd38d7ed04f2af7f322d9590bb11c340b764d5db3ede
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e39ce9d6c7ded8e44f32bd5c5587ac29d953860681cc922276953d33b425cbe1
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c5b029e7369136dafcb60d62fa18181080289e4d24a2e5037669fcf55efd4f3c
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 24044e669704298af71e37d9f483b44be0ef33f827c063766f11c0ccd01ca4b8
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 775941336499a7b0d377dc6ae33a4c478f18812d670c3c109a38a14a65de87e5
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 fc5b5a2a935d79c81eb8447c6a2d07b0707c6b4d6cf4f13bd5e8821201a83d3e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 dbde1f4d26679e4f1b14b77d32851364f3ca5bea14d0ebf57db4c53c82634366
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 9c688e8f4c96cb2ab1e7cc0a4bd84c8951460b92ae17a4eb6916c1d344a80fae
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e7ad8042b125b3707d8e40ea9eccf89f78cf339e84c826629efbf72556b11c69
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\gikYEcQo\qqQMcYcw.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6a39739fe05d791a9292ab9e282551501aab669cde64c9fa3cc26f6905e41ea8
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    vkIo.txt
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\vkIo.txt
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-24_e2e5d71e205c986b4a0e70caafd5ff40_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 877a075d562eead534fb9a5c61a5488c2d93c04190d2b301699eb94922f372c6
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    UosgEsEI.bat
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\UosgEsEI.bat
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 112B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 19B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 0d421c443df029e6dd76aeacbd1bc91bbf3936d64222214549c6ddb0d4e14e6b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e80ad5dca9a04afe1b071c7bfaca40e054341c06fc36a36a9224c7087b43d6fc
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1b8bee2e8cb96f453a86dc451bcab02d04435519e213881f93ef8c92b4c3b179
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 054f6e3888b1ae43b0813d634f313ae329342fc99a2c647e00d279d368cf047e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6a5e1353da42c393dea08ada106271f7e1d99ece67464a94cc3c88d42b7dbd25
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1f36e5fe6cab33ff39b63aae7e3b94790a8d68165062edfb54eb00c8aefee32a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 955b8ae577327bea07c72c000455a4393def9b0e2e01166065635934bd5b357c
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 30100b13e97eb5228d8010a1feaddc9d0e02b4f3b45360a2bdd56bec43fc2bac
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d90f413e7c2534e16ab78eece6a1a54523487e275ba90f83f4e29bf27c4e28a1
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 347aeeb75143bdd52d1389f89d7d6f9e399896533096da5750f3b09353da6c53
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 979915cc76d045a98f7de7d19e9cb1ffb8d95b8f5bce95bc95252511bb36f47f
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7201e4cdf620677da056595b48684b02c815a352ca8a3b885e86cb9fd01edee8
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 56bb1dab5d9603c4fd519ad1b8af3a6adbf2ebcdec4da41014cbc4b5a5fc7be2
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 cc87abf47e661c95e4112b072d6b15cb1cd9ee5b7047f3aa0c92b0dd4c57fce9
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 43ade743c6e2a99cd38b2fc0b40f1508755e84ec3a45b903ec78870da3fc70ce
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 20eaeaa99d2076bf7f173aa2925800d7c43e559c736825a98f09b2488464ebf9
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e671e96e9515140f4a17462e5c76f4c50a70ac641675c46ba49985cfc895f4e1
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7f523a81668412f4c789f56f891aa60581f1aaab175cc67d69dbd0e46412e18b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e4330cf904be908512b4d648c45e921af8229225347d1d89a05134629b2b059e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 0bbd2e3b20d17fbe0da6ff8632278d13b13dabcf9a25c73e4f780252739e0f0b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 492cf403d7f4670856141e4b8e9a0dd66acb0f43e890c2ef56ca94eff3b23a10
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 8391305e5357ba7a19cf664307706a5e37a8ec28097c1fc5606ac861eca64157
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 db9dba50218870bd1aff8b58f9b9b7770ce7d2929e5b28e5a9144bf34dd4f76f
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 be3edf243241af5bb121b16c2cf316aba276c3723657440826ce62e46d062e22
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2e03df6794eb02d76530c673206ecfe99bacec37c9b8a8f7792b3a2502b9e0eb
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 47581028083588aaf89ed8c63f201075358024f5fdaf1d3a7ad4ba9ed39d3a6e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 22f26af40b365f893e258702d4df35d08f8f921950cfb911141cdd514df7cc33
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 470e4d9e54c3db13650acb5b2939775633f04bdf0dda54797e1433ce8157ec6a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 22aceb3a41b525a983fe5bb2a81a1b2f8c2926ccc1e3273699184c76c6ea5942
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 b5975e81a056a69fb35e28d43d56589ced6f6a2a87e0499177697a5612ff8261
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ace9744cb7f73955a0b54ec665db2a17473a13e31a2123a750248063d3d9d923
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 378a558b048d910c248882df56cde8eeeb949fa7302233182ae4e3e72f24cb53
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1a2171112aa238c5c2fdf93ad665f4c253e104ca7ef489372a8629d0700a4b3a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 024ea92b4b737ba16d921cd4d61b2a6769b6baf24b4f79d9d741216cd897eb4b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5985d6dcf02e7c03415866ea9bb9c12e97da1bf482fb2c37caad5a24124dfe34
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 29dbee7b55d71fd6a0684da28ec45bb3ae756d584de3379c31dcd3897e11a3e0
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 17bf7642464006cc259ec48821f618e69d29f4cf5de6b457c4c6d7630b80ecf7
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1bd401db06e5c61117444172069476232a4663030651c3daf0bb63284b5dd012
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 12d4f10729f90f3891c4b10511847d7289fc9ce39943034419ff814ab8b1466a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 067e3474895378461365d7db6cd9ed462aebfaeceafbcdfff2de46a694914237
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 bedc30a180afe413a483b9c6c0d025b400fe0a042cfb626e0b651066e9b8f352
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a524ce6e246464bf182c7394499071dcf521507eb156392196f29ae8d71c9ea0
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 92e0f3c49dfe7c00d0eb36b18feafbe40074f58c9ff0b292e59c0dd353f2907b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 256119e66706479b6da0700efd5ee042eb7571f60cc7d456c0fcc1f36143ca89
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6987cf0b04feafbcce9019abe3f8c3931e10eac9a180a9371938dc534176c70d
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 8ebe18296846b7168e8525a00357a9ca7a4ec4293601b62ca6b9f8d95b0c38c6
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 69aaba055780d563b7a138835be21baa8ce62f75b60a30fe71146964bab7c3fa
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 15bd50c57fc1cca984c0164dea754a13fc055b747c483c9d5ef19799a4a26083
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 071316370e2fbe2e2eddbf08d248be4046b3ec4109e5ef95828aed4e64c61700
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e04e8c816268d8414fcd88a56e7c44476468871b42db2d1f3d003f3c744feddb
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f3409d96d4574c7692fe5a293fae6287eec46feb473fa190ea8afd1e02bd143a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 433c039eec7b18630ed95918d2f15c70dd3b229eee57c90c2326ae3cfd489981
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ad1486c1f4417058aa62bb57490cf329b4c8c3d76e833908b5761a14e24ab5cf
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c6a35a5305e68b7cd50c1708c80cab78b177ad75e64d675b533f6eac47ae337d
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 93d23b474c1b5f5231db2a0811c51994fc8032254f891755f59913d5c0d591fd
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 fbce7edbc2601493903b2aaddd9a173c7e62e79bb73a37b843d958c9b15b56e7
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 0e34b3b1b75afb43e7ed747341a3ac656deba0396fb36ba515bd533c88d49d6e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4a397e02d430f3a7f4816b138e108905f2ce0ce2e0efe6c814fc717cbdfddc88
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 8f14fc1763e89d22c77e1415d9bf763a22844757af91108ca3cf657063ebdd5b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 67b3609a7642e370ddd29d7fd266bb16d2f0a2f193f04e3e9e0475a5592809a1
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1de2f3e211e618eff204a378a69b01e1f9bcb46906fb82475e2f0948de4176f0
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 0b7d9c58b50bb497f0e76b2c5e3fb789d012ef5f2dbc8e28b1e1f3def1e24a75
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 b9e35faa4bbd8720e295a9e357274719131fd49115b2e395376153e96c0eba9e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7044a6e82bd0439f627b88d1d2a65b3b1c04b0f2e5e3d6157ffcae5358c2494a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d5562cde94772576b9f49831298afe54469432a4ea87a2057d5cf4c682c9273a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a718466239350806e3a20daccaae02bac2aec5644475467f5ca4c540e6199c51
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 bc62f1bf4fc4262edbe64def2dbb3909429169e60f19ca98fe52600bd9ec3af5
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f4a9d5eb7c092f70e5bfc415a0b30ba5bb3e5b6545ee8a5fd9019b5f8e5b61e9
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6aad0776f648b7afda65ec17594197988b6af478b3ab167edd89f2deb1255ae3
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4fe81f123ee03353606cb349cc3120ac7b02dfabb77434606a5103b8f3d9582a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ff0f74b02ba3dffa0de2a864d13a48b154620d6f068a4e1c8a8cf69699639529
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c99a115e38a633daa37af73d66bae55af81d52fab7ec976b3b2b8ec8ba6aacbb
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 629a362e34ddfac38239274ec6c6fa48ddf0ab26e2f139abfb4acf55fccc7fcd
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4479629e10004c024b1b210316bc95c5bd1918a8fc05de0f3f53b9878cca6343
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 638acd7920420ec98dca7e01207e077dc418b51c704ef93da7227cbce26df728
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 56c8fefdd86f3853cd8950b3f3f7704fb1cda4af1cb545a4fd3e9eeb4e88d024
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 822ccbb197e5c1917a5899442730ecb7746c42b45e037ae291af26890f7839a4
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f6d05a8fe2bf83348d7de2b5a5304d6fb4f9ecb89e46c0b4ae73b35d1f3379cb
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5cdc479cf5e825db11bd9b12d5e7bf25b2d3be6fd55f1982c173c674e02741e1
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 223733d5b0c509a7f941ea6e417aa6179e94e4f4537a793ca643333b8c2608c3
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2b5cdb424174d1bf2eb9b1961f25ce150d7eddf390565763466e130eda3be6c5
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 eb16774ab12138a548577ccc635a7b171d86bf827a9ef2877da5286e10067417
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 8f5a4496b0422b77a14bb0e30866dd9a6ef1d51e89dbacc33d27ea03978438d3
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 b46bd43ec14bc6922408829054b9ae83485c83760042a2ed268fe49bbc78b8bf
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 acb34f7674ef800a4553723e086de68fc7642d759f6b1a180dd7ab21e0cde0cd
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 90908b1f49d4c69e2cb68b7021994207081c056196c2728cfc7ece85ce6982f1
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7fc65d9c6dd4efb90856cbc9add8e29107701d28d657d152f836a207e826ad84
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c8d8068345d92c151acefecc441ab03b19bf2e602155328611fc38c2b83d6a4b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ab5e98fd4006efae3fc1968136cc0b0d2a7868c8eadeb619c1786ec544b913af
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 9b839f557502dec5018ecf4a765abf13ca37ce5b95cc68169238a136c1c822fb
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5685b13dd17f92e36877feafe23c593dd30311bb4af79a80682642385753ad6a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1954c320ef980d0c5a1867f3271805ab9fffea4f79b103315592e6e0021ebafc
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f8b95b9306ccf5c7cf360e7c8831a8a0648fb3093b3d5bdcfcc1c24eb355d8b2
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2313d0a74c218ece68cc48b4eac2d004b15acd6e2d5de04a0582aa0deefc30e6
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 634bd56b6331f5638493a47c1171ea52819cf952407a679cdeb6cff8fa2ba4e5
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\nIQQgwco\XUMoAsEI.inf
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 dd80187ace9656c12c466fc55f27716c3acaf5aab68fc891c7a255cbc4657d94
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    AAsC.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\AAsC.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 382d98ae37f5a669a8cffc2273426f7f985795eb7570abe9b2ea4a450a11c0c4
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    AEIc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\AEIc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1b37e782aefc79ec5c6001cf4dbe337521adc445551bbb9f17f6fe6822dad2be
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    AEIc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\AEIc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 b9fd75d072ad8e79d95678c77631f96f7a9ed43f2b204b3b9970a17ea3bf1557
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    AwEi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\AwEi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5bfdd863ddb22528e6166cdcf91237f56eddd5aab51038804e6068ba2f61a1ea
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    CAga.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CAga.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 60d345c970205539f92bb14a62987b9025d68c911aad083326014576615c5e7f
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    CEQY.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CEQY.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 0747fb63deeebf514c26965d73dddd65bbc665441db834d01bc8ee04953c4b99
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    CUUE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CUUE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 304619838875290382b27af883b6e50721bd4efead3c1fa63afcba4789bbc092
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    CUYK.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CUYK.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 448dfc9ddbe48ac6a792e636885b4cca42fff0c57df1eb1d189f4fafbf700154
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    CYQa.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CYQa.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 53e50a65e1bbfa972df7ddd6e9bee6f62ad616a3c02a97cdda3010f0f031e9fe
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    CYUG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CYUG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 020fe269e589fdf7524d8d93e91c1e5a309f63799afafd3f91e2b359ab17a02b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    CYYQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CYYQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 916dbd8a2cf4e2a0c9c689c977c73f066c2ef37110e414c8177e770acb9c9634
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    EgYo.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\EgYo.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 afa9c0b153d26f3cbfdfc82bb1fcc9f21930394aec3470bffb04f84c38cdb4fb
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    GMkO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GMkO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 067aed70b41570453e63e16fe41b1b8d306cdb03b6749b89f91a1e3e7b368843
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    GMki.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GMki.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 bffba65a840203ed068236a8144010d83868cf9063771cd4eb214c7b54a6579d
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    GQEq.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GQEq.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f23b89473e51a206b65997fc51f866e33796189575d6ec50d7ba82cc5991ea6e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    GYEO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GYEO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 657f3aa57daba5675fff62131eac52cd2ab23625bcec9f3e0324cd8d3b3b2444
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    GYgG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GYgG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 369faf1de7c6368ad7bb0c0b36f3c962cea715cde7e10983f3abe9e17a6be41c
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    GcIM.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GcIM.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 3948e9ba3a256769ab16d1f9ffbf38a8c4706be13dbed577031dd9e9fa0e20c8
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    GkoQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GkoQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f5e4b28c475ace00ca26c40d713ff730db43ebaf4663fdded26470c853b69a71
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    GwQy.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GwQy.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e25e61de29b3b22e5cb9060ae86a7b5dd811fe91fc3129173ba4fb6e6423c657
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    IEIO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IEIO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 8d25866dd682ace144654d4bbdf0b1e5b4b015c1d75270ed737fd010b35fed28
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    IIAu.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IIAu.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d89badc1c1b6adb6a77a3b6e6cf65480b85362b615ed3f1e970573f5e4ab6d5a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    IMQQ.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IMQQ.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    IUQm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IUQm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e07fe07a59f7c35f500274b19fe5cbcf145c35d97395b49726dc9b23365de205
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    IcUM.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IcUM.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 251b50b5958f1734ca77f1ba45f11073cd5b7d094bccb1ad69477d36a3475900
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    IgcS.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IgcS.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d3a745454a00fa8bc87fcd555c6a27d71fd7cf637e0ef3d77b5297b431bff264
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    IyMw.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IyMw.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    KgkA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\KgkA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 47f704f4433d3f1110401d909055aa9db6c3442c788cbf4b940218c2b292da41
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    Kosg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Kosg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 3108d28eec2d53f01227a6812a8f392845e201b9d85c721a11505199db4230fe
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    KssI.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\KssI.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 529561a36c63b8d4eb0978b9404f06d7b4d10712fccb2d80828dc3f0c0961366
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    MAMq.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MAMq.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 955bd219423fa9c531f8216954b5189be6e905f3ecf50ba091e49ce34197ff81
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    MAUa.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MAUa.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 8dad76f564d75ed21b36aeaae636252976a27036bfa6256481ce23984ac0a01b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    MIQA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MIQA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 533543f034bddad6cc9edc3a7b7fef1b947d6f5eb43be7ae872a6724a1171ee4
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    MIkM.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MIkM.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    MYEs.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MYEs.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 18b7eeefaea1a3491cc63370bb5f7e5744f1e65bb07a1a59d8453e6aaf92bb3a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    MoMi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MoMi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1367040ca173b568f707c5b1d3ae041b06bd57f5b61251c19db3859af23b0cc7
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    MsIU.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MsIU.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 24e538d79e41a28d9fa61992382188f6461ee79b9453f7c93972d289666a305b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    MwkW.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MwkW.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e08cbbedac94ef3ca5a2680f2e73a6fa0a35df6d342e4364b3144b4b78cb54c7
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    OEUO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\OEUO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a8bb80275e2660d2fbfc3c482435a162936498064145c9b7c56d75ff08b26a0a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    OYgg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\OYgg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2d1a4031c3a58ff9f524bdfe354e0d3413210a9f74ce29eab84125a3df4cd4b9
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    Oigw.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Oigw.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    QEYA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\QEYA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5f928d1c20400774288302792072b9e124ce1731d0647cfb4803d443b8ad26cd
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    QmsA.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\QmsA.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    SAMW.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\SAMW.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 89e153bcc669d5d392a58ef79261c786233824c62f8132fd1f4f96dc4373db71
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    SEYg.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\SEYg.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    SMgQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\SMgQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a4754bc2fa817c25bf9ca9745342d2354d35cdd585dec50a906f0ec21e4a7e15
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    SQwE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\SQwE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 00e6d51a85a1c3970c1e9d2b2417c2e31527f826c69bb191de435e892f731847
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    SgsM.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\SgsM.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.8MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 3019899b37ad0dea24e9155bf1a1a8ead3fe90c0329d49835b9f8a780f380e29
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    SsUo.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\SsUo.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    Sscq.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Sscq.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e46680c94ea3c1e6b08259d05fd7ac19d79b2b20eea6bcff722c4fdeeb0828ef
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    Ssga.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Ssga.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 8f4fb980a8e7deb8f25aa5a2b449ce5e489a6c7648a20034509186ca56871378
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    UEQA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\UEQA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 892a1c6ed01d88c402146c1994ce00503a602cc5f424c13c17f837cd1828bdae
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    UYcq.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\UYcq.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2c15bd3bdf7dfec021ed9a9c69f16e0d853fb89bd357c90d43f84a05422c31a8
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    UgQA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\UgQA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 000e8e92a049726d2b86e9804b835576924c180c08e7a7ec0f2cd8082feaa0d5
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    UgQO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\UgQO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d0603e2aec8c7de6c45101cdd74f03cc477f75351bf10111e72e8e26909a0bfa
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    WMQQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\WMQQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f086c9ea91c3d9c69f4d2421997abb442f05490443a78c5aa32e378427588c77
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    WUoE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\WUoE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e523c1e0b2f65326410004104d7c27902491f9bfc3e836c77708bc1f5a189c11
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    WWEY.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\WWEY.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    WYwe.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\WYwe.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4e1baf545f03f694ac614d181e35b6493916b7bbe2fa9c67155e6b272520ae2a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    WcMg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\WcMg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e64179cda8f410f52fdb1964ea7b659aa1ca18115371875593acff8bb0119818
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    WckE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\WckE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f6f286bc6e2f51088c030b0657f871144b56362816b1fccef351e37cad284c74
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    Woou.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Woou.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 50b1949ab792dc44211f8d431e6a65a9f01a354d871d7640da04014f8f19a35e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    Wosw.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Wosw.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1679409699f6f4fd35d7d4d04e2b0791e2735eccf358bcee64e197cb33cdc486
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    WuEA.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\WuEA.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    YQEm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\YQEm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c8b82e4663fc36f1fd61747e001d111629623b4ef1802265c491476306dff519
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    YgUO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\YgUO.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2021175ee4e5d9e720c6a46a9548cb8b40fba6b22835dd3dbb663cc42bcabf32
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    aUgA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\aUgA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 dedee4633b7230d805f14d2b48059a7c6a9ce5813178bae625c122abb63efacd
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    acgu.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\acgu.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 30c568ee92e5f5d72dc9da9c0304092eb5133d6bad4a748661f5ca06f1eee86f
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    akce.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\akce.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 4e471713162720f8c1b92e2ecfa3aad664fd68cb289ec18fc4d67f9ff99d2b4e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    aose.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\aose.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 54ccec9e623e89802b026d8bad10933b7dda998fd24cbc51811f3d9297ed2626
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    cIQm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\cIQm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a09b0617a5a0e5143594bff95864832abe727120fdf23f925bf1469ac1f3743a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    cwsg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\cwsg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 1360829a971c27a36f1fc611d28dcb79b914613bc34f7f25e50b76abcb5c8b4c
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    eAAG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\eAAG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 48ba475c8ba0b20d6cf137af34c1819c4fea76c0fa2eb86f6940b47f1096aed8
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    eQEg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\eQEg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 36a4ad9ff138f8b4f38f24ebc5b4bcd052fa6d7622e6723a4716cbe2ab7a200f
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    eYsE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\eYsE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c64ed6ae8cda8a11329b3eae35d01f6a9e679484ad86261141509bea2a491c89
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    egYG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\egYG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 fe8b8b566460833a84fcf8f29cc2e31a396a2f459780851809c88e6550d920a9
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    ekcK.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ekcK.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 8b841732f86c1c707688b299cde5b37a7f6cb8ba76c2edc70bba8229e6cc1eb9
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    ewQa.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ewQa.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2befe700bdc1c6aba83d8d348e66de41c11909a3084bfc0139799464107f670d
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    gIsw.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gIsw.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    gYgA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gYgA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f2b7a09f5b5f8b1dca4f6c40be7e6992b7f3043c8c06306bbdbac40c53983b29
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    gcEa.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gcEa.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a8be97135ddaccf1f4a0a3de217b1f65ee688b0110e13e2faaf0dea01eaeed43
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    gkUs.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gkUs.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 90d7727b84c1d64b5be7c17b676643af4c8676c231c175449d5b7adb8b76383c
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    gowG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gowG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d22c8b4ac9cc9013bcd711413cf62ac7345b38f629652ef0f40429732374dcff
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    gwEg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gwEg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a1cf8d98a67ab9854a781c3785e987d99e5fe6d311fbd445046e1838c9da74d9
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    iAwW.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\iAwW.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5af79c06dfe3d49b698889f9a68e67bca4e179f0ecd3a3904360de783304ce36
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    iEUa.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\iEUa.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6b31f0c6691222334e955836b92b60f52a377118504f8c45ad959634bd98029b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    iQkg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\iQkg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 63d5562a9fdf71fba1615e0b569139928ef74c687f77415d6b08e8047a2de738
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    iacQ.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\iacQ.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    icUS.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\icUS.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 2360755466168d6bd5c1ab144c7a26faf9ba54ad40bcbc5e4bcae69ba7d29e00
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    iowo.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\iowo.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 145b042f0182e343f29ffbe02db530cbe7bae495894b8811fc6512c78e1f2252
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    isIK.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\isIK.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6807562cccfb143fad38523c011a3142824be54ae0efdeae46be0ac2cc4bd2ca
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    kCkM.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kCkM.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    kMQM.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kMQM.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 905d5369b761836931e8c76e4621a29e124b8f1b0ae557a421a9dc778300f5b4
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    kYIw.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kYIw.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 6f59fe67bba0feb70d70f87e73d125ba54cba17f8664476ebe0a85cdc43e6628
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    kYUu.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kYUu.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e8ddf75f781abfbf7f223bc96fc0f9b4dfe7fc21bca11814e92ce4dcec0897b6
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    kcQY.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kcQY.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 81bfa60cff17657325fb6f347ab2314e7cd7fa3b81d5a12d51d1bbf04289d2de
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    kcgI.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kcgI.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f7457344e9500360f4859d26e1a2d3dc06896bd8b567d767d897e26716ab8705
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    kkYi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kkYi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5f72c960b23d6a198e65516082fda3490fd1a13089259ba141165d7e1b9e8b8b
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    kmIc.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kmIc.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    koQe.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\koQe.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 606a1d3f396835b409924cabc94820ca2bbbc29068e2775bb0456d1c35b74f99
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    koUC.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\koUC.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 eb869eba45ab2de312d22347cb42b3b45bc015f222f7e284df9f1f7cb5b090e3
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    kssS.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kssS.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5ca5b0346c61470892a4c57cb974cea37e56c0be33c9c4cb1b38b19a260bf13c
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    kwYk.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kwYk.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c00429062ea8e35b7b3cf1262539be1975ec85ce9dcd3a363c63a537b7100bdb
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    mYYs.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mYYs.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 22d1fe7a31d1490dbfe30a3e532183aa434dd27754d452b077a4660860317ffd
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    mYsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mYsc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a366a68be7e00fe9e286353468df65cf351ec49882f4c4689813e4fe3b92ac39
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    mgMi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mgMi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 3312c3d5843cb398f8b39a10d0b0a7d944455b385885bbcd70148bed9adc3be7
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    mkgA.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mkgA.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    mowQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mowQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e2fa61cfc64d616b7f4c346c40b80c0cabfe29539cb9d8e1cb90f57ad50063be
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    oAYq.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oAYq.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 caabc66e89c5ab5533852de43c786760866fe1b02cb4a38c50aa5c9faf281f48
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    oEEg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oEEg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d4c7c78ef4dfa73a88531923424de068f460b8730445a475d46b01ed57c5fae0
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    oIcG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oIcG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 84c7ad4b33217d7bc344c2f493749c454f36283212104ca22b59266537f156a6
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    oMIU.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oMIU.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f951b8b7c7e2838b9872ba6cdc27dd1b9690a9ed6f774edfd9c33b0c1a76b2c9
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    oMUu.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oMUu.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f491623ffd89cad8ce9dbc4885fed6fb12d56c37c111112408aabbeadc168556
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    oYcI.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oYcI.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f4e351f153889b8a742029220e8f1e7e7f2bcd1e648aea829e55ca6a53714ea3
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    oYsG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oYsG.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 224afdef3476843ce50471f80a485c0b6f1a42150755299eb875bc7225ee7af0
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qEUi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\qEUi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 424af877339765763da40480557256a40350826413190840953b11f4f6c9f749
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qMoi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\qMoi.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 aeedbe9e0c09c9efc80c8fa50ac4a39617e3a77b2e4a797ed3a9e32cda6efc2e
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qkYM.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\qkYM.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d09b33d3071e49b2fe649b2ac443952a2d876c1d3c0b546309d6f3e7ba9d349a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qock.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\qock.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c59faba28efe8906816820f97bce2b7d8f3632c85eda81c28c895f9aac4a0d45
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    qskw.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\qskw.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c7252bea8c98c3b38c9415081aef54d26490af237f46cd5b959e6563b91e6777
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    suEo.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\suEo.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    uEME.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\uEME.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 3178599cdc5e43546a94fba186ef933e5ad3d08e14c11bd6033d37f77ef398aa
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    ugkE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ugkE.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 a6af46e59e24bda418195e7cbe4030d16bc87beb680e7026233e15a4068508b3
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    ukgk.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ukgk.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 b5f145dab9d59d016040a82d6c3156a33b8e9a30b9b8606c0980470884bc65b6
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    wEMK.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wEMK.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 429d0dbcf626d2a3ebfc7d75ff66e2f74f0303b58ae7fffcf66600eb58b04639
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    wIwC.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wIwC.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 818e672c43b63235d5122db4b9d2b5fdd253b838b3f36a529fae3e90b1311577
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    woIc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\woIc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f3090ab937c76e64cf93eef5662080e607ab6537c10b403a96ba871b6b73e931
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    woUg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\woUg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 c74fb90d1671b606c02700c02acf8ea891c55ae6fcd12c3977eb2aef7af7265a
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    wwsA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wwsA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 f1aff17bc5314f0ec45d7c2752e551612d261ef69634db1f7b0d4643fc2ec974
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    wwwu.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wwwu.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 11c86bf64f0cae248e07715866fd81fcf354818bab597b6f26a199b58d88f241
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    yCos.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\yCos.ico
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    yUES.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\yUES.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 d1f63d669c151c2c56c60a214d72e733d141a0f7d5edf03b05a78cb6c6f6f00d
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    yUoW.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\yUoW.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 93a8dd5b0bbbbe71ef09bdff0506d3d540c79b8bdcda05cb71b6951058368ab3
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    yYwK.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\yYwK.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 70d1d38c07260cb499ab5a46f40b857088d59ef657d313d3e8ffdbae54be873c
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    ycgk.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ycgk.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 7f1941444c84ea19c6f455c9ca0a1e2f223e4e6fb7b782162ab396fe626ce629
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    ygYA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ygYA.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 df8a1770ac37679275edde6bbe133df8e8853fcf3c0168c7b76ca9b25d50cf41
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    ysYg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ysYg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                    • SHA256 34b4d21239be0f470734a64388fe6987e5576d5496e001d24bc82a9cbc6fa867
                                                                                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/200-1801-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/540-1967-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/596-1854-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/608-1678-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/912-1926-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1244-150-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1300-317-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1392-194-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1488-1863-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1608-1779-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1608-1791-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1648-1719-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1732-235-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1748-109-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1828-256-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1884-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/1884-2160-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2024-296-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2084-0-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2084-1-0x0000000000B90000-0x0000000000BB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2084-31-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2084-32-0x0000000000B90000-0x0000000000BB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2112-212-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2172-1999-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2320-2017-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2368-1954-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2444-1760-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2512-1773-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2540-2008-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2560-1844-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2704-90-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2788-136-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/2956-1701-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3084-49-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3280-287-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3548-1869-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3548-1886-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3568-1932-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3568-1945-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3704-1973-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3704-1986-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3772-78-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3908-35-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/3908-2183-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4140-2155-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4140-8-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4152-1904-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4200-1314-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4204-1977-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4268-1832-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4388-265-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4404-2174-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4424-67-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4564-1936-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4616-1710-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4708-1733-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4772-224-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4800-1688-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4908-101-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4908-123-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4912-1751-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4916-275-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4932-1873-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/4956-1783-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/5028-1823-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/5044-1895-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/5096-1913-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/5376-247-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/5400-2165-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/5400-20-0x0000000000400000-0x000000000058F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/5480-451-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/5784-168-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/5988-181-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/6048-1742-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/6048-1729-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                    memory/6132-1814-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                    Download