Overview

overview

10

Static

static

3

2026-07-17...ck.exe

windows10-2004-x64

10

2026-07-17...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 03:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
  • Size 1.6MB
  • Sample260718-ef76qaax8s
  • SHA256 e41e70c097ab7967a78c18ef7fb66431984d8ed302724600ecc93acddde3e5e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 13 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 13 IoCs
    defense_evasiontrojan
  • Renames multiple (91) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 4 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 13 IoCs
    execution
  • Drops file in Windows directory 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 26 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Users\Admin\EuIkEcYo\kIYEkYgw.exe
      "C:\Users\Admin\EuIkEcYo\kIYEkYgw.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5156
    • C:\ProgramData\UGkEgIQw\sOkoIEIY.exe
      "C:\ProgramData\UGkEgIQw\sOkoIEIY.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5568
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3948
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5816
          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1612
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:928
              • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1624
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4860
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4512
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2592
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                        11⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:3708
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5984
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:3564
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2844
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                                15⤵
                                • Adds Run key to start application
                                PID:4260
                                • C:\Users\Admin\IGYwYgYM\WqQIMQMg.exe
                                  "C:\Users\Admin\IGYwYgYM\WqQIMQMg.exe"
                                  16⤵
                                    PID:6124
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 264
                                      17⤵
                                      • Program crash
                                      PID:1088
                                  • C:\ProgramData\SMYUUoEI\JgkgcEcs.exe
                                    "C:\ProgramData\SMYUUoEI\JgkgcEcs.exe"
                                    16⤵
                                      PID:2368
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 264
                                        17⤵
                                        • Program crash
                                        PID:712
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
                                      16⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2488
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                                        17⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:3340
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
                                          18⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:1980
                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                                            19⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of WriteProcessMemory
                                            PID:1940
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
                                              20⤵
                                              • Executes a command shell one-liner
                                              PID:4368
                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                                                21⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1952
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
                                                  22⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3380
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                                                    23⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:5412
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
                                                      24⤵
                                                      • Executes a command shell one-liner
                                                      PID:1864
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                                                        25⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5524
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock"
                                                          26⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5936
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                          26⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Modifies registry key
                                                          PID:1988
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                          26⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:916
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                          26⤵
                                                          • UAC bypass
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:3376
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WicUcIwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                                                          26⤵
                                                          • Executes a command shell one-liner
                                                          PID:804
                                                          • C:\Windows\SysWOW64\cscript.exe
                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                            27⤵
                                                            • Executes a VBScript file via the Windows Script Host.
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1204
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                      24⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:1880
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                      24⤵
                                                      • Modifies registry key
                                                      PID:3744
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                      24⤵
                                                      • UAC bypass
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:2800
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iWkokgko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                                                      24⤵
                                                      • Executes a command shell one-liner
                                                      PID:5584
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        25⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        • System Location Discovery: System Language Discovery
                                                        PID:256
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  22⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies registry key
                                                  PID:404
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  22⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:1448
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  22⤵
                                                  • UAC bypass
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:3776
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LCUAUIQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                                                  22⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4692
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    23⤵
                                                    • Executes a VBScript file via the Windows Script Host.
                                                    PID:5008
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                              20⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Modifies registry key
                                              PID:5792
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                              20⤵
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:4484
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                              20⤵
                                              • UAC bypass
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:6100
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HqYkUoMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                                              20⤵
                                              • Executes a command shell one-liner
                                              PID:4896
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                21⤵
                                                • Executes a VBScript file via the Windows Script Host.
                                                • System Location Discovery: System Language Discovery
                                                PID:1744
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                          18⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Modifies registry key
                                          PID:5052
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                          18⤵
                                          • Modifies registry key
                                          PID:2960
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                          18⤵
                                          • UAC bypass
                                          • Modifies registry key
                                          PID:4944
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UeIkEwoQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                                          18⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:1048
                                          • C:\Windows\SysWOW64\cscript.exe
                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                            19⤵
                                            • Executes a VBScript file via the Windows Script Host.
                                            PID:4276
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                      16⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:4352
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                      16⤵
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:540
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                      16⤵
                                      • UAC bypass
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:5476
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        17⤵
                                          PID:2208
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wMQwoEYw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                                        16⤵
                                        • Executes a command shell one-liner
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:6108
                                        • C:\Windows\SysWOW64\cscript.exe
                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                          17⤵
                                          • Executes a VBScript file via the Windows Script Host.
                                          • System Location Discovery: System Language Discovery
                                          PID:2284
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                    14⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry key
                                    PID:5384
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                    14⤵
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry key
                                    PID:5968
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                    14⤵
                                    • UAC bypass
                                    • Modifies registry key
                                    PID:5348
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\acIsIkwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                                    14⤵
                                    • Executes a command shell one-liner
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4160
                                    • C:\Windows\SysWOW64\cscript.exe
                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                      15⤵
                                      • Executes a VBScript file via the Windows Script Host.
                                      • System Location Discovery: System Language Discovery
                                      PID:2636
                              • C:\Windows\SysWOW64\reg.exe
                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                12⤵
                                • Modifies visibility of file extensions in Explorer
                                • Modifies registry key
                                PID:6020
                              • C:\Windows\SysWOW64\reg.exe
                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                12⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies registry key
                                PID:6040
                              • C:\Windows\SysWOW64\reg.exe
                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                12⤵
                                • UAC bypass
                                • Modifies registry key
                                PID:3688
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YggoUEow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                                12⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1160
                                • C:\Windows\SysWOW64\cscript.exe
                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                  13⤵
                                  • Executes a VBScript file via the Windows Script Host.
                                  • System Location Discovery: System Language Discovery
                                  PID:5772
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                            10⤵
                            • Modifies visibility of file extensions in Explorer
                            • System Location Discovery: System Language Discovery
                            • Modifies registry key
                            PID:4248
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                            10⤵
                            • System Location Discovery: System Language Discovery
                            • Modifies registry key
                            PID:4276
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                            10⤵
                            • UAC bypass
                            • System Location Discovery: System Language Discovery
                            • Modifies registry key
                            PID:5340
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAAYMksY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                            10⤵
                            • Executes a command shell one-liner
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2096
                            • C:\Windows\SysWOW64\cscript.exe
                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                              11⤵
                              • Executes a VBScript file via the Windows Script Host.
                              • System Location Discovery: System Language Discovery
                              PID:3200
                      • C:\Windows\SysWOW64\reg.exe
                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • System Location Discovery: System Language Discovery
                        • Modifies registry key
                        PID:5360
                      • C:\Windows\SysWOW64\reg.exe
                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies registry key
                        PID:3164
                      • C:\Windows\SysWOW64\reg.exe
                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                        8⤵
                        • UAC bypass
                        • System Location Discovery: System Language Discovery
                        • Modifies registry key
                        PID:900
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZqkAgkcM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                        8⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:5548
                        • C:\Windows\SysWOW64\cscript.exe
                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                          9⤵
                          • Executes a VBScript file via the Windows Script Host.
                          • System Location Discovery: System Language Discovery
                          PID:4152
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                    6⤵
                    • Modifies visibility of file extensions in Explorer
                    • Modifies registry key
                    PID:916
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                    6⤵
                    • Modifies registry key
                    PID:6108
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                    6⤵
                    • UAC bypass
                    • System Location Discovery: System Language Discovery
                    • Modifies registry key
                    PID:2208
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BggUYIQo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                    6⤵
                    • Executes a command shell one-liner
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2932
                    • C:\Windows\SysWOW64\cscript.exe
                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                      7⤵
                      • Executes a VBScript file via the Windows Script Host.
                      • System Location Discovery: System Language Discovery
                      PID:4820
              • C:\Windows\SysWOW64\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                4⤵
                • Modifies visibility of file extensions in Explorer
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:5076
              • C:\Windows\SysWOW64\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                4⤵
                • Modifies registry key
                PID:4816
              • C:\Windows\SysWOW64\reg.exe
                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                4⤵
                • UAC bypass
                • Modifies registry key
                PID:2688
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eiswIMUA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
                4⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1636
                • C:\Windows\SysWOW64\cscript.exe
                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                  5⤵
                  • Executes a VBScript file via the Windows Script Host.
                  • System Location Discovery: System Language Discovery
                  PID:4384
          • C:\Windows\SysWOW64\reg.exe
            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
            2⤵
            • Modifies visibility of file extensions in Explorer
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2312
          • C:\Windows\SysWOW64\reg.exe
            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
            2⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:5068
          • C:\Windows\SysWOW64\reg.exe
            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
            2⤵
            • UAC bypass
            • Modifies registry key
            PID:2956
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nAYMwcQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock.exe""
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4080
            • C:\Windows\SysWOW64\cscript.exe
              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
              3⤵
              • Executes a VBScript file via the Windows Script Host.
              • System Location Discovery: System Language Discovery
              PID:2028
        • C:\ProgramData\vGQYkYwA\RWgoskUc.exe
          C:\ProgramData\vGQYkYwA\RWgoskUc.exe
          1⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          PID:4848
        • C:\ProgramData\UGkEgIQw\sOkoIEIY.exe
          C:\ProgramData\UGkEgIQw\sOkoIEIY.exe
          1⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          PID:2676
        • C:\Users\Admin\EuIkEcYo\kIYEkYgw.exe
          C:\Users\Admin\EuIkEcYo\kIYEkYgw.exe
          1⤵
          • Executes dropped EXE
          • Adds Run key to start application
          PID:3620
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6124 -ip 6124
          1⤵
            PID:4360
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 248 -p 2368 -ip 2368
            1⤵
              PID:3940
            • C:\ProgramData\MqwAowQQ\GGwggckM.exe
              C:\ProgramData\MqwAowQQ\GGwggckM.exe
              1⤵
                PID:4552
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 264
                  2⤵
                  • Program crash
                  PID:3160
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4552 -ip 4552
                1⤵
                  PID:3428
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc
                  1⤵
                    PID:4636
                    • C:\Windows\system32\compattelrunner.exe
                      C:\Windows\system32\compattelrunner.exe -cv:kPGGSVp3V0GSfOm2.0.1 -wce:0000000000000208 -fullsync -m:aeinv.dll -f:UpdateSoftwareInventoryW invsvc
                      2⤵
                      • Drops file in Windows directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2392
                    • C:\Windows\system32\compattelrunner.exe
                      C:\Windows\system32\compattelrunner.exe -cv:kPGGSVp3V0GSfOm2.0.2 -wce:0000000000000208 -fullsync -m:devinv.dll -f:CreateDeviceInventory
                      2⤵
                      • Checks BIOS information in registry
                      • Checks SCSI registry key(s)
                      • Enumerates system info in registry
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3392
                    • C:\Windows\system32\compattelrunner.exe
                      C:\Windows\system32\compattelrunner.exe -cv:kPGGSVp3V0GSfOm2.0.3 -wce:0000000000000208 -fullsync -m:aeinv.dll -f:GetApplicationKBs
                      2⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2076
                    • C:\Windows\system32\compattelrunner.exe
                      C:\Windows\system32\compattelrunner.exe -cv:kPGGSVp3V0GSfOm2.0.4 -wce:0000000000000208 -fullsync -m:appraiser.dll -f:UpdateAvStatus
                      2⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1084
                    • C:\Windows\system32\compattelrunner.exe
                      C:\Windows\system32\compattelrunner.exe -cv:kPGGSVp3V0GSfOm2.0.5 -wce:0000000000000208 -fullsync -m:GeneralTel.dll -f:RunGeneralTelemetry
                      2⤵
                      • Enumerates connected drives
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3728
                    • C:\Windows\system32\compattelrunner.exe
                      C:\Windows\system32\compattelrunner.exe -cv:kPGGSVp3V0GSfOm2.0.6 -wce:0000000000000204 -fullsync -m:appraiser.dll -f:DoScheduledTelemetryRun
                      2⤵
                      • Checks BIOS information in registry
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2180
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
                        3⤵
                        • Drops file in System32 directory
                        • Command and Scripting Interpreter: PowerShell
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5000
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
                        3⤵
                        • Drops file in System32 directory
                        • Command and Scripting Interpreter: PowerShell
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2164
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:908
                    • C:\Windows\system32\compattelrunner.exe
                      C:\Windows\system32\compattelrunner.exe -cv:kPGGSVp3V0GSfOm2.0.7 -wce:0000000000000204 -fullsync -m:invagent.dll -f:RunUpdate
                      2⤵
                        PID:4396
                      • C:\Windows\system32\compattelrunner.exe
                        C:\Windows\system32\compattelrunner.exe -cv:kPGGSVp3V0GSfOm2.0.8 -wce:0000000000000204 -fullsync -m:aemarebackup.dll -f:BackupMareData
                        2⤵
                          PID:1368
                      • C:\Users\Admin\IGYwYgYM\WqQIMQMg.exe
                        C:\Users\Admin\IGYwYgYM\WqQIMQMg.exe
                        1⤵
                          PID:5796
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 232
                            2⤵
                            • Program crash
                            PID:4644
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5796 -ip 5796
                          1⤵
                            PID:2412
                          • C:\ProgramData\SMYUUoEI\JgkgcEcs.exe
                            C:\ProgramData\SMYUUoEI\JgkgcEcs.exe
                            1⤵
                              PID:4748
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 232
                                2⤵
                                • Program crash
                                PID:2924
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4748 -ip 4748
                              1⤵
                                PID:4836

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Command and Scripting Interpreter

                                    3
                                    T1059

                                    PowerShell

                                    1
                                    T1059.001

                                    Visual Basic

                                    1
                                    T1059.005

                                    Windows Command Shell

                                    1
                                    T1059.003

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Privilege Escalation

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Defense Evasion

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Hide Artifacts

                                    1
                                    T1564

                                    Hidden Files and Directories

                                    1
                                    T1564.001

                                    Impair Defenses

                                    1
                                    T1562

                                    Disable or Modify Tools

                                    1
                                    T1562.001

                                    Modify Registry

                                    4
                                    T1112

                                    Credential Access

                                    Credentials from Password Stores

                                    1
                                    T1555

                                    Credentials from Web Browsers

                                    1
                                    T1555.003

                                    Unsecured Credentials

                                    1
                                    T1552

                                    Credentials In Files

                                    1
                                    T1552.001

                                    Discovery

                                    Peripheral Device Discovery

                                    2
                                    T1120

                                    Query Registry

                                    5
                                    T1012

                                    System Information Discovery

                                    6
                                    T1082

                                    System Location Discovery

                                    1
                                    T1614

                                    System Language Discovery

                                    1
                                    T1614.001

                                    Lateral Movement

                                    Collection

                                    Data from Local System

                                    1
                                    T1005

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    sOkoIEIY.exe
                                    • Path C:\ProgramData\UGkEgIQw\sOkoIEIY.exe
                                    • Size 1.6MB
                                    • SHA256 2202c8b27f2b0449bfa8090afce0712610fef1ae037f55df30f9b18018b33d15
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sOkoIEIY.inf
                                    • Path C:\ProgramData\UGkEgIQw\sOkoIEIY.inf
                                    • Size 4B
                                    • SHA256 1a889485b4b05fe4baeed3b799ffa394204aba3ed7cc0c4463ff6b7396148890
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    sOkoIEIY.inf
                                    • Path C:\ProgramData\UGkEgIQw\sOkoIEIY.inf
                                    • Size 4B
                                    • SHA256 cd25f18b2a1bb10f55bf5ec791ebd15501f572323a5c7343dffbc474a10fa483
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    qesE.txt
                                    • Path C:\ProgramData\qesE.txt
                                    • Size 9KB
                                    • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    RWgoskUc.exe
                                    • Path C:\ProgramData\vGQYkYwA\RWgoskUc.exe
                                    • Size 1.6MB
                                    • SHA256 b1d557c56f676a353c9e278fbe015faef39333323105326c41d4b765c474239b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-07-17_51ccaea48df7bf6bb539dac71fc970bb_elex_virlock
                                    • Size 2KB
                                    • SHA256 7e9997f40d13b32c724ca4ecef283f377ce9965d31534167994e654d6e6623b6
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    file.vbs
                                    • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                    • Size 19B
                                    • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    nAYMwcQw.bat
                                    • Path C:\Users\Admin\AppData\Local\Temp\nAYMwcQw.bat
                                    • Size 112B
                                    • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    kIYEkYgw.exe
                                    • Path C:\Users\Admin\EuIkEcYo\kIYEkYgw.exe
                                    • Size 1.6MB
                                    • SHA256 d81e5b39a63d3d14d1c334c15218b5f669f0f2b4fd4f204d999e00b78d6e0e6b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    kIYEkYgw.inf
                                    • Path C:\Users\Admin\EuIkEcYo\kIYEkYgw.inf
                                    • Size 4B
                                    • SHA256 537326ae5f4312bf0179a7d80a7b095f65f49a9466d2781a0a0217aff808dea3
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    kIYEkYgw.inf
                                    • Path C:\Users\Admin\EuIkEcYo\kIYEkYgw.inf
                                    • Size 4B
                                    • SHA256 dff64046a56e9f0e262064786bd848a58b042b0c890ffddf9eb698ced06a7887
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    kIYEkYgw.inf
                                    • Path C:\Users\Admin\EuIkEcYo\kIYEkYgw.inf
                                    • Size 4B
                                    • SHA256 a75e18ec52bb0f99e3f2691454ac712b6932bb46615ad70e4d37771400dd8f43
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    kIYEkYgw.inf
                                    • Path C:\Users\Admin\EuIkEcYo\kIYEkYgw.inf
                                    • Size 4B
                                    • SHA256 21b4c6c69e7b41fbf06a4b184e15ab83f01e30432a25f940c24c73504812e151
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    AEkM.exe
                                    • Path C:\Windows\AEkM.exe
                                    • Size 2.1MB
                                    • SHA256 f059406124f73be51af58667814d05776ffa3fe56c70b052fbdc123623d9e039
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    AQMO.exe
                                    • Path C:\Windows\AQMO.exe
                                    • Size 1.6MB
                                    • SHA256 04e812e6867b84cac0360531a6149f66d2c7e983076cc676f62d163303bbcf71
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    AYAm.exe
                                    • Path C:\Windows\AYAm.exe
                                    • Size 1.6MB
                                    • SHA256 e934d70c49714db0699877351a050c3a340032721eee67f611fcd83449a070dd
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Acga.exe
                                    • Path C:\Windows\Acga.exe
                                    • Size 2.8MB
                                    • SHA256 3eee9ee9d920945286f3bcf82fc3360548811fad990a1201fc1c8e8792d54de2
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    AgUU.exe
                                    • Path C:\Windows\AgUU.exe
                                    • Size 2.1MB
                                    • SHA256 bf834ebf0a48217c9e77e439899391597fb2d8d4a5b714dcc76385e6233729e8
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    AkMk.exe
                                    • Path C:\Windows\AkMk.exe
                                    • Size 1.6MB
                                    • SHA256 828a9a83b84a3ea53bd66701d4595153fb95211d8dc081728895fe96c17511e8
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Aoca.exe
                                    • Path C:\Windows\Aoca.exe
                                    • Size 1.6MB
                                    • SHA256 c78ff1d2f7ed06b1a197b7c6ece63af04ca03fc9b28703532211ca4eb37afeac
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    CIsq.exe
                                    • Path C:\Windows\CIsq.exe
                                    • Size 2.0MB
                                    • SHA256 417ba1b2bc29d379e4d56ea4c6a021bf2ddf4d4a1bd1ce29b249b33b6d13ebe1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    EAom.exe
                                    • Path C:\Windows\EAom.exe
                                    • Size 1.8MB
                                    • SHA256 d221074656821dc31c2ec23b491087ea6012e92b73e481c66cc432d4cf29a3db
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    EEYu.exe
                                    • Path C:\Windows\EEYu.exe
                                    • Size 1.6MB
                                    • SHA256 cfe287edbbe431acc6c5d28a9dec1c17dafd0f98f39bdc2aef643747bbe2d56c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    EIoA.exe
                                    • Path C:\Windows\EIoA.exe
                                    • Size 1.7MB
                                    • SHA256 3bfa09bad996ee7125db94bf8950a9852b4688ca1687c8c6f097f94078957c7b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    EMgY.exe
                                    • Path C:\Windows\EMgY.exe
                                    • Size 1.6MB
                                    • SHA256 9aad393ca08451a3e5e137445bc3134aad3bc07257aec8be357e1e76585f6f91
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    EQcI.exe
                                    • Path C:\Windows\EQcI.exe
                                    • Size 1.6MB
                                    • SHA256 47bf5d1862af24fe79c803036e3c5f1e95d0eaa9a9d6535496448a10c6cf801a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    EUsW.exe
                                    • Path C:\Windows\EUsW.exe
                                    • Size 1.8MB
                                    • SHA256 e4a8abfdded7abe7709b8e75c517ce2518200b528c92b21410236e56fce7548b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    EYcA.exe
                                    • Path C:\Windows\EYcA.exe
                                    • Size 2.4MB
                                    • SHA256 164b1fd4f968bc028e0e0305c066ee4f8a6d0f77496248b8942f31c46fbd87a6
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    EcsG.exe
                                    • Path C:\Windows\EcsG.exe
                                    • Size 2.1MB
                                    • SHA256 13f12b2bc7a89496c01afe2e7b3086ecde716ed472737ba6e6ae8fef7d49ad4a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    GAUK.exe
                                    • Path C:\Windows\GAUK.exe
                                    • Size 2.1MB
                                    • SHA256 5b3396fc3447c891f3eb4d4632cb851f05af611c6d61571244667e3e5b534496
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    GYYs.exe
                                    • Path C:\Windows\GYYs.exe
                                    • Size 2.0MB
                                    • SHA256 086d4cd0a8434e2cf4c8a72013e68b46ee5ee9fafeab2788750aebf6c56e42e4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    GosO.exe
                                    • Path C:\Windows\GosO.exe
                                    • Size 1.6MB
                                    • SHA256 6510418afe21deeaf967ad986329452d1b81b202fc3ce50fe6f25933d43e0847
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    GwMe.exe
                                    • Path C:\Windows\GwMe.exe
                                    • Size 1.9MB
                                    • SHA256 316a99fdfd41319dfebbf6b8fa3fe3bbbb843d5bc04fd8c709ce57cea23837bd
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    IUQQ.exe
                                    • Path C:\Windows\IUQQ.exe
                                    • Size 1.6MB
                                    • SHA256 eee208d7c6508211d1980e5e674d9c25c051800f9ae1513feb7eb255a14d8bca
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Ikgc.exe
                                    • Path C:\Windows\Ikgc.exe
                                    • Size 1.6MB
                                    • SHA256 e662a724626e73fecac865cd6e20764177d9ae309fed0ab951f9743414796fb3
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Iswc.exe
                                    • Path C:\Windows\Iswc.exe
                                    • Size 1.8MB
                                    • SHA256 78bb0a0a33197d4fd28b9d75edeae428b8f1bce49308f6071666776e405cdf2f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    IwUi.exe
                                    • Path C:\Windows\IwUi.exe
                                    • Size 1.9MB
                                    • SHA256 d9ae14c5c2a90cd9f639fce85edd4f2777a1c3a75efcf989ab25e6d970a89c31
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    KAQc.exe
                                    • Path C:\Windows\KAQc.exe
                                    • Size 1.6MB
                                    • SHA256 bdaa08c3b389346da07373ee6c625fc068ad31a4bc2f72bdac443545c80e8e54
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    KIwK.exe
                                    • Path C:\Windows\KIwK.exe
                                    • Size 2.2MB
                                    • SHA256 332975ce789a5e33132c729f392c17633f47fc921af59a1e1d613e9e238f4c0f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    KccC.exe
                                    • Path C:\Windows\KccC.exe
                                    • Size 1.6MB
                                    • SHA256 67efbfeba9ca6263d2b4110c33d21b109e0f9e13c0b39d97012e0f9898469669
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    KgwU.exe
                                    • Path C:\Windows\KgwU.exe
                                    • Size 2.6MB
                                    • SHA256 ffae925d30c33a30af523188b14eaf27880ccab17a01d34302283f78dc69122a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    KooY.exe
                                    • Path C:\Windows\KooY.exe
                                    • Size 1.7MB
                                    • SHA256 cad176739060aaaea4b2383bca1fab0dfec383c30d7f0d37c147d74aa5047291
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Ksss.exe
                                    • Path C:\Windows\Ksss.exe
                                    • Size 2.0MB
                                    • SHA256 caa9413f004a0a06b774c063f55af90245820e1687bff533711ee26a5c2ec3af
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    KwEe.exe
                                    • Path C:\Windows\KwEe.exe
                                    • Size 1.6MB
                                    • SHA256 e5b494df296dcf74249d160fa4c2036d04e2f748e718694f5cdc5917e9de4b1b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    MAwK.exe
                                    • Path C:\Windows\MAwK.exe
                                    • Size 2.4MB
                                    • SHA256 434ef77c628e76a5d01a725c803ba12c0f4bd5ea17ef90d9daf03c5e1323f878
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    MIYM.exe
                                    • Path C:\Windows\MIYM.exe
                                    • Size 1.7MB
                                    • SHA256 9bde595abc33b1e315351202642ed323bcb0a5c1500772e248d737b3d10c530c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    MIsU.exe
                                    • Path C:\Windows\MIsU.exe
                                    • Size 1.9MB
                                    • SHA256 b26b711f50295f8b874dcdbaa1232d10679d3cb3c9cbe31d10f1b4a955907721
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    MUso.exe
                                    • Path C:\Windows\MUso.exe
                                    • Size 1.7MB
                                    • SHA256 70111550564efd6561ea6cd298c6c5aa0b8f4b35f163c4de288f21d6cc6b0f6d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    McUO.exe
                                    • Path C:\Windows\McUO.exe
                                    • Size 1.8MB
                                    • SHA256 083f0dba3bcdcc3a8459f130e2be51430b6f1ff418e0449b4e2f2b3e04a741cc
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    MoYY.exe
                                    • Path C:\Windows\MoYY.exe
                                    • Size 2.0MB
                                    • SHA256 59056ca5f38b8b8d2d736381d60f816deb5179886ae1eb9779b424d8a82f4d5d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    OAwO.exe
                                    • Path C:\Windows\OAwO.exe
                                    • Size 2.0MB
                                    • SHA256 e7ae1eac1e4dbcbefe8f623c5f26a5a9382157c03a8575d6baa392e96988fb8a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    OIwO.exe
                                    • Path C:\Windows\OIwO.exe
                                    • Size 1.6MB
                                    • SHA256 69f471784918bab30427f5ef9bc9ec916c5eefa5842a069c9e79aeae4a25deaf
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    OQAi.exe
                                    • Path C:\Windows\OQAi.exe
                                    • Size 3.1MB
                                    • SHA256 7ed076fca8d01d1cf1bf121d64435605525a176224dee91cfdf5cbb9783fb359
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Owko.exe
                                    • Path C:\Windows\Owko.exe
                                    • Size 2.0MB
                                    • SHA256 a6f76183015c6ed5593bdfab68b0b3a1b22f5c0916081c7d55a074a924a704b9
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    QAgC.exe
                                    • Path C:\Windows\QAgC.exe
                                    • Size 1.9MB
                                    • SHA256 596a8ab577e843953b2fe06898e611e4132ee315801787a88312f5dc28097757
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    QYYG.exe
                                    • Path C:\Windows\QYYG.exe
                                    • Size 1.6MB
                                    • SHA256 80cb68957452c5b59a8011f3c87f16101214958d07acaf0e11e8bd1f9e30543f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    QswA.ico
                                    • Path C:\Windows\QswA.ico
                                    • Size 4KB
                                    • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    SIEU.exe
                                    • Path C:\Windows\SIEU.exe
                                    • Size 1.7MB
                                    • SHA256 b49206fe3813a42ee8d5559ef182e4bf053811655a3e2e9184a7159d1a164a39
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    SOsQ.ico
                                    • Path C:\Windows\SOsQ.ico
                                    • Size 4KB
                                    • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    SkgU.exe
                                    • Path C:\Windows\SkgU.exe
                                    • Size 1.7MB
                                    • SHA256 4449513ed667d07e779ee4c471d524c274831abb31608cc9f16c804c22563621
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    __PSScriptPolicyTest_y2g4g224.b4l.psm1
                                    • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_y2g4g224.b4l.psm1
                                    • Size 60B
                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    UMwE.exe
                                    • Path C:\Windows\UMwE.exe
                                    • Size 2.2MB
                                    • SHA256 e900c66f7abd0ea2d11758a514db9d80de8188513e460b63d703933a978384bb
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    UcII.exe
                                    • Path C:\Windows\UcII.exe
                                    • Size 2.2MB
                                    • SHA256 7d8462548367e3e5b9224149eb3c29085ca5fb5a205ad6575c6f21eb5e3021e4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    UkAy.exe
                                    • Path C:\Windows\UkAy.exe
                                    • Size 1.7MB
                                    • SHA256 7dbd99f48efa19c82bbc1554c53527cba55ae4d42397233249098d8f776dbccd
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    UkgU.exe
                                    • Path C:\Windows\UkgU.exe
                                    • Size 1.9MB
                                    • SHA256 5c6ff0528fb132712b853c574a619d19ddc74650a932f22bf9db20ac878f6ea6
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    UkoU.exe
                                    • Path C:\Windows\UkoU.exe
                                    • Size 1.7MB
                                    • SHA256 836ab40ca6ccfb439c8b7a45f99e0aeabf65e47758919c905fb3efcbe6a8a2b1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Ukom.exe
                                    • Path C:\Windows\Ukom.exe
                                    • Size 1.6MB
                                    • SHA256 87ce93f035c314746df1adbfa4f4d9968f1dba25018ddd384a6b3233968ededc
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    UwMo.exe
                                    • Path C:\Windows\UwMo.exe
                                    • Size 1.6MB
                                    • SHA256 cfd85448e6ffa8eb60a9ce9e4aafc7087ff391edf88b115b5c4fb20ebe128ad1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WEYo.exe
                                    • Path C:\Windows\WEYo.exe
                                    • Size 1.8MB
                                    • SHA256 119994aca42b09a2c331aae5142ea353506e007a704d64d8bc0b707efd6271cd
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WMAy.exe
                                    • Path C:\Windows\WMAy.exe
                                    • Size 1.8MB
                                    • SHA256 55ffe645f145ff38599ffffa52c383152c4b1d6dee6fe692943153d07a6304fb
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WcIG.exe
                                    • Path C:\Windows\WcIG.exe
                                    • Size 1.6MB
                                    • SHA256 d88f1f013b7e60dc1e2a5b621f8ba9f2589202b1a85ac56085af109a6747e1cd
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WkUU.exe
                                    • Path C:\Windows\WkUU.exe
                                    • Size 2.2MB
                                    • SHA256 9a1debef454513fb30ef86c94e56d511c81e4bc53581da54d08944ab47fb1cd1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Wkoe.exe
                                    • Path C:\Windows\Wkoe.exe
                                    • Size 1.6MB
                                    • SHA256 8fb7ff241e25661708fc9233cccba4ff3720ab4e40c1025c7dac45b348056d09
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WsYq.exe
                                    • Path C:\Windows\WsYq.exe
                                    • Size 1.8MB
                                    • SHA256 e899aa4ccffffddbfcebbb622911a2357e42ebd2f43464a8306b1e4b1610b241
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    YAIa.exe
                                    • Path C:\Windows\YAIa.exe
                                    • Size 2.4MB
                                    • SHA256 bcaa435094a6458629af887b3c8161af01aec3fb0f640c18572e2fd41413603a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    YQUM.exe
                                    • Path C:\Windows\YQUM.exe
                                    • Size 2.0MB
                                    • SHA256 abd7470bc1a076049f2fe60ee6c9ba03ddbd403894412364805d6644f7639b4d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    YUkc.exe
                                    • Path C:\Windows\YUkc.exe
                                    • Size 1.6MB
                                    • SHA256 6662315ce756e622db0909bd8bf60932aa275d6bc31dac8cf64b412fc1256453
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    YYMi.exe
                                    • Path C:\Windows\YYMi.exe
                                    • Size 2.5MB
                                    • SHA256 c4e4c27ce1d66e694f9f09bf0d0744cfda5b1dee8f38742ac7b8837a6fac8863
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    YoUQ.exe
                                    • Path C:\Windows\YoUQ.exe
                                    • Size 1.8MB
                                    • SHA256 26a71c518843ac901ef740a6b0c2c1fd1e6c978369090aeec5c34830692996b0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    aGUc.ico
                                    • Path C:\Windows\aGUc.ico
                                    • Size 4KB
                                    • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    acAC.exe
                                    • Path C:\Windows\acAC.exe
                                    • Size 1.6MB
                                    • SHA256 0ebcfe6da80621d811b5319811779be967175d9018e391c194f0d380c7b15d46
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    agQY.ico
                                    • Path C:\Windows\agQY.ico
                                    • Size 4KB
                                    • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    akYm.exe
                                    • Path C:\Windows\akYm.exe
                                    • Size 1.6MB
                                    • SHA256 55843ce807fe47cf77395266f6d5ca176c1aaba268d819f458df980434e0e156
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Appraiser_Data.ini
                                    • Path C:\Windows\appcompat\appraiser\AltData\Appraiser_Data.ini
                                    • Size 144KB
                                    • SHA256 2784e24c5a64c99e66eee425259c9f70500072ad65b96932dc863505993aabd8
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Appraiser_AlternateData.cab
                                    • Path C:\Windows\appcompat\appraiser\Appraiser_AlternateData.cab
                                    • Size 2.0MB
                                    • SHA256 7d6b3f8c594e2c140d219383782437f0b68ee1de2e0ce0348fcec3e0e5e50b61
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    asEy.exe
                                    • Path C:\Windows\asEy.exe
                                    • Size 1.7MB
                                    • SHA256 a2fb779346d29e88313bdfa8b67a3cb87dbfcde7be8328f9eb8f2de4a8f3939f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    awUe.exe
                                    • Path C:\Windows\awUe.exe
                                    • Size 1.6MB
                                    • SHA256 1db6ec0e4496e57ea21341fb17f7ca69f9ba78095875fa80858c194c75562a5c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    cYUy.exe
                                    • Path C:\Windows\cYUy.exe
                                    • Size 1.6MB
                                    • SHA256 5e06fb3bf0b19024210720eab5462a7524723213139250811b9cf17616ba6739
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    cksk.exe
                                    • Path C:\Windows\cksk.exe
                                    • Size 1.9MB
                                    • SHA256 8e562f9b40cfee3f2fb85519749463ebbda2064d59eb4c855fb792e5c091a4b9
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    eEsS.exe
                                    • Path C:\Windows\eEsS.exe
                                    • Size 1.7MB
                                    • SHA256 2b88c3b8bd2f0b621ea4c1458aed0d4db664f6a196140163d14471282f835e45
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    eOIc.ico
                                    • Path C:\Windows\eOIc.ico
                                    • Size 4KB
                                    • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    essK.exe
                                    • Path C:\Windows\essK.exe
                                    • Size 2.6MB
                                    • SHA256 1c61b7681c5514065ab0ac4dd32c8490cc96ac42786e06b45d03649e94aa0145
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ewoS.exe
                                    • Path C:\Windows\ewoS.exe
                                    • Size 3.1MB
                                    • SHA256 8e1442a777122f0fe397a8edc3f5b5878776b868bbfb57ff03fcd1574821784a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    gUQE.exe
                                    • Path C:\Windows\gUQE.exe
                                    • Size 2.0MB
                                    • SHA256 668bfedd813f6df25f043e3edb83f8b74f5c4cc68a4d1c3602208d7b4ef85dc9
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    gUYM.exe
                                    • Path C:\Windows\gUYM.exe
                                    • Size 1.9MB
                                    • SHA256 38a7ab5f5d103ec60a6452061fd217084cb77e39c85033b2bad720d71fb562e7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    iYAS.exe
                                    • Path C:\Windows\iYAS.exe
                                    • Size 2.3MB
                                    • SHA256 da292b9fa80c6dd8ee9bc54e993f349b7e5b275945394692f28ebec1cde725e5
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    igQQ.ico
                                    • Path C:\Windows\igQQ.ico
                                    • Size 4KB
                                    • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    iggK.exe
                                    • Path C:\Windows\iggK.exe
                                    • Size 1.6MB
                                    • SHA256 34aa35142d644f5713a322aebf671ce5429929788678fede84e45806f5ac9161
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ikwu.exe
                                    • Path C:\Windows\ikwu.exe
                                    • Size 2.2MB
                                    • SHA256 6daabcb492cddc1b3033fddc9cdfa43d0a17409cdd53827b53588949e29c17b1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    isAw.exe
                                    • Path C:\Windows\isAw.exe
                                    • Size 1.6MB
                                    • SHA256 48e748ed91ac5555c97232434a4476869e268e63de75afa429519aaa0208ceef
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    iswo.exe
                                    • Path C:\Windows\iswo.exe
                                    • Size 2.1MB
                                    • SHA256 13331d979f7d76c8518ce8f31f5d966025033e56810791f20ca0d878b7ec2ba3
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    kEEo.exe
                                    • Path C:\Windows\kEEo.exe
                                    • Size 2.2MB
                                    • SHA256 652c071aa3d66785fd0dd858ee410c153234c7a80cf74711b894d78c25047380
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    kEQw.exe
                                    • Path C:\Windows\kEQw.exe
                                    • Size 2.1MB
                                    • SHA256 33256e1aa6d383ff682180f395e02d8464ec063c2229cbcbcb4fd2d06309c08b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    kcQe.exe
                                    • Path C:\Windows\kcQe.exe
                                    • Size 1.6MB
                                    • SHA256 1864f67f705a97d2ec3e6070479f182ad194af51583f5c15d2c4205a5a1de313
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    koUU.exe
                                    • Path C:\Windows\koUU.exe
                                    • Size 1.8MB
                                    • SHA256 39d9480bb3aa0eb34c86bdff7ee3a07cae2a43862809f0847675e53c24a78ac2
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ksAe.exe
                                    • Path C:\Windows\ksAe.exe
                                    • Size 2.0MB
                                    • SHA256 b3615691c4c82171540fa948bb54dee5ca504b80ea90d1572f642ef90fe0eb37
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    kwAU.exe
                                    • Path C:\Windows\kwAU.exe
                                    • Size 1.6MB
                                    • SHA256 f1a7523223a4d73eb4a16271b55191a1cb672d357305d8699d3133e7feb9db8e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    mQIM.exe
                                    • Path C:\Windows\mQIM.exe
                                    • Size 1.6MB
                                    • SHA256 e6b02b6e6fd6f0fe58c77060d90fa7d8426d73d9b1698c1fe0ab61b5fc60445b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    mYgw.ico
                                    • Path C:\Windows\mYgw.ico
                                    • Size 4KB
                                    • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    mcYw.exe
                                    • Path C:\Windows\mcYw.exe
                                    • Size 1.6MB
                                    • SHA256 28fcfc307bf4514ff0b9d4a150a0a79bcd93e7b530068be4c7fca75f6dc34d86
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    mwEo.exe
                                    • Path C:\Windows\mwEo.exe
                                    • Size 2.3MB
                                    • SHA256 0e134825b6985125eee99529a6c1f5879f9b98df3924e6c47e0a5cf9e811f5e0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    oAQY.exe
                                    • Path C:\Windows\oAQY.exe
                                    • Size 1.6MB
                                    • SHA256 875bc6d73b1a0df9e44237fb6fd373044e7a97a347d8f3bc7c88cde1251a228e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    oIIq.exe
                                    • Path C:\Windows\oIIq.exe
                                    • Size 2.0MB
                                    • SHA256 76739045915ca91d569b0de377845004785580cd6a05693589b8dda0691e15ca
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    owUA.exe
                                    • Path C:\Windows\owUA.exe
                                    • Size 1.6MB
                                    • SHA256 728109c709f1a046704bcbf3f98ff715abdafb97be02b83b33f6b2dd82a1dbb6
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    qIQY.exe
                                    • Path C:\Windows\qIQY.exe
                                    • Size 1.6MB
                                    • SHA256 91982313c9941e24e96f5e67e3f4eec6930dadcc56b64dd726e97c86b3a08aa5
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    qMwe.exe
                                    • Path C:\Windows\qMwe.exe
                                    • Size 2.1MB
                                    • SHA256 bac9705770dc6ad0a39d67f86859b9d2126313ce84f2140bece8ddfbaf98dd0b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    qcIs.exe
                                    • Path C:\Windows\qcIs.exe
                                    • Size 1.8MB
                                    • SHA256 3dcf3206da193ef395cdd2f21a7a574ec5d30eb35d407c182185eacaa6245d43
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    2576425336.pri
                                    • Path C:\Windows\rescache\_merged\2118023660\2576425336.pri
                                    • Size 2KB
                                    • SHA256 f6f4c6ac3750138ba90518a8a910306bedf35abd47486100241027fde3a7ba8e
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    3567570158.pri
                                    • Path C:\Windows\rescache\_merged\3906713228\3567570158.pri
                                    • Size 167KB
                                    • SHA256 d2f3b8a7d9442d711bcfa1cf25c4b038ab8be2d01ba4c6e0fa34ff09147bc7b7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    433427886.pri
                                    • Path C:\Windows\rescache\_merged\4136552255\433427886.pri
                                    • Size 6KB
                                    • SHA256 eb5e6e1d8a29cf99d4bd6808776e0b84e7104a521812a38cb927b174b0bb6ad5
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    1023422952.pri
                                    • Path C:\Windows\rescache\_merged\4264460956\1023422952.pri
                                    • Size 4KB
                                    • SHA256 b6c16b22cef5df81b77a9b16ee5cf51930362e3546c431574e313fa2497bb14d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sAQC.exe
                                    • Path C:\Windows\sAQC.exe
                                    • Size 2.5MB
                                    • SHA256 269e689c878e3727ca979e890905a0131cf956ccbcef5e1f22108744ad06f8fd
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sEMo.exe
                                    • Path C:\Windows\sEMo.exe
                                    • Size 1.6MB
                                    • SHA256 7e82dd2967dcb4ab6b1ad5e3bbff05e4217dc4a49456be94bc1fb2ec53e6d675
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sMwa.exe
                                    • Path C:\Windows\sMwa.exe
                                    • Size 1.6MB
                                    • SHA256 dcc827570eac29467ed82e81ac74032f481d76b315c47724b0d89b0c5b2d8a32
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sQQK.exe
                                    • Path C:\Windows\sQQK.exe
                                    • Size 1.9MB
                                    • SHA256 70ece03a0da9f284626c8e7cf9d8a51546de5bdef4b2b8b791c8e7cbe25a6aec
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sYAE.exe
                                    • Path C:\Windows\sYAE.exe
                                    • Size 2.2MB
                                    • SHA256 92c10b71b74216548a158ecf3d04ecd311ed8e910500f831b5d8840c7529a905
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    scYS.exe
                                    • Path C:\Windows\scYS.exe
                                    • Size 2.1MB
                                    • SHA256 31a9085748c408ee010411ef65f29256f6d022c2b26e3df198837d3088fe54c1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    skMM.exe
                                    • Path C:\Windows\skMM.exe
                                    • Size 2.2MB
                                    • SHA256 cdadec1430dea8b3a4b41ac4f5495cc68c417a12cd8bdc308a3474c76d4d657d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    skko.exe
                                    • Path C:\Windows\skko.exe
                                    • Size 1.9MB
                                    • SHA256 264e2448a5887ed86a540026b76931b62ea34004597731876c0e842d83790db6
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    soUe.exe
                                    • Path C:\Windows\soUe.exe
                                    • Size 1.6MB
                                    • SHA256 4ea42306905a0b5ea31466c97166e7a367ce61ad040f7a1ea6f3a6db2d655005
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sscU.exe
                                    • Path C:\Windows\sscU.exe
                                    • Size 1.6MB
                                    • SHA256 3e9f4d74e2573690de0a93e1c117c4637450d684d655c07c5ec06f0fbfa172d9
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    uAEU.exe
                                    • Path C:\Windows\uAEU.exe
                                    • Size 1.8MB
                                    • SHA256 b8622687203279210ec5a0ffa7d0ba1ab503afe9c89a953c8a039c8f17a36188
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    uOQQ.ico
                                    • Path C:\Windows\uOQQ.ico
                                    • Size 4KB
                                    • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    uQIy.exe
                                    • Path C:\Windows\uQIy.exe
                                    • Size 2.5MB
                                    • SHA256 0ecc9c7f3ab5fa64d883c4eea2b27c813b968cfa3263128726e796f0e5390a6e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    uUYe.exe
                                    • Path C:\Windows\uUYe.exe
                                    • Size 1.6MB
                                    • SHA256 63d11ccc3ca764ae3a83d3a5aff25a84de9b2becc99a352b85f01da0f43aec36
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ucgg.ico
                                    • Path C:\Windows\ucgg.ico
                                    • Size 4KB
                                    • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    uwcm.exe
                                    • Path C:\Windows\uwcm.exe
                                    • Size 1.6MB
                                    • SHA256 1456a7796c184fd1bc571f5782581a0104768842602c4945251862da2f19a282
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    wEks.exe
                                    • Path C:\Windows\wEks.exe
                                    • Size 1.6MB
                                    • SHA256 2e8d4656a10c54d04a0f0d0269aedc9a71f71df7a8710172e094b8d2afaa9902
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    woIw.exe
                                    • Path C:\Windows\woIw.exe
                                    • Size 1.6MB
                                    • SHA256 4e5a7db6e74399fc989da79e13a7eba1809e1e0b5cd1c161dfa1c2d9446d8160
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    yMgK.exe
                                    • Path C:\Windows\yMgK.exe
                                    • Size 1.7MB
                                    • SHA256 e72790349d95fd8a96d241c40ba93ebb3f2d7420add97242fddba6fd2e719287
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    yMgm.exe
                                    • Path C:\Windows\yMgm.exe
                                    • Size 1.8MB
                                    • SHA256 81583c28d05986efb6ac7f9c95b06b49d68ff01f182347312180fc59fa29aaa9
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    yQwM.exe
                                    • Path C:\Windows\yQwM.exe
                                    • Size 2.0MB
                                    • SHA256 37f1b3d6c043f4f418174731aad6a5f002e589cfd1b03222ef04e00aba458b34
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    yUca.exe
                                    • Path C:\Windows\yUca.exe
                                    • Size 1.8MB
                                    • SHA256 c9e44dd5c361d6b330e3729e0f9fe51d06355b9c3c2d2b66c076ed08e98f20e2
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    yoYS.exe
                                    • Path C:\Windows\yoYS.exe
                                    • Size 1.7MB
                                    • SHA256 6ea324d48371207c9188625e6a369cf62b9d4978270e5a79eb1a5489916dd005
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/1612-64-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/1624-77-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/1940-181-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/1952-201-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/2180-2925-0x0000025AF78D0000-0x0000025AF78D1000-memory.dmp
                                    Download

                                    memory/2368-144-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/2368-133-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/2676-1869-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/3264-30-0x0000000000A50000-0x0000000000A70000-memory.dmp
                                    Download

                                    memory/3264-0-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/3264-1-0x0000000000A50000-0x0000000000A70000-memory.dmp
                                    Download

                                    memory/3264-29-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/3340-165-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/3340-150-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/3564-120-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/3620-1874-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/3708-108-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/3948-46-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/4260-146-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/4512-91-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/4552-143-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/4552-134-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/4748-151-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/4848-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/4848-1856-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/5000-2945-0x0000015A2C4D0000-0x0000015A2C4F2000-memory.dmp
                                    Download

                                    memory/5156-1846-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/5156-7-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/5412-213-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/5524-223-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/5524-259-0x0000000000400000-0x0000000000591000-memory.dmp
                                    Download

                                    memory/5568-1851-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/5568-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                    Download

                                    memory/5796-168-0x0000000000400000-0x000000000058F000-memory.dmp
                                    Download

                                    memory/6124-128-0x0000000000400000-0x000000000058F000-memory.dmp
                                    Download

                                    memory/6124-145-0x0000000000400000-0x000000000058F000-memory.dmp
                                    Download