Overview

overview

10

Static

static

3

2026-07-17...ck.exe

windows10-2004-x64

10

2026-07-17...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 04:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
  • Size 1.6MB
  • Sample260718-ewdbaaf16p
  • SHA256 364329f0684c061171025cf492a7c4669c94747695dfc4cff1ddd69905ae2f88
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Renames multiple (106) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 11 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Users\Admin\CwwosgYc\BYYUwAMo.exe
      "C:\Users\Admin\CwwosgYc\BYYUwAMo.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4064
      • C:\ProgramData\JwYwgIIs\EswkAYUY.exe
        "C:\ProgramData\JwYwgIIs\EswkAYUY.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:4864
    • C:\ProgramData\JwYwgIIs\EswkAYUY.exe
      "C:\ProgramData\JwYwgIIs\EswkAYUY.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of FindShellTrayWindow
      PID:4860
      • C:\Users\Admin\CwwosgYc\BYYUwAMo.exe
        "C:\Users\Admin\CwwosgYc\BYYUwAMo.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:1812
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3508
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:456
          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1700
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5292
              • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5860
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2684
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                    9⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2652
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3056
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1080
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5092
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                            13⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5728
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4052
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                15⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4256
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:480
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2724
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2476
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                        19⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4808
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:2948
                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3768
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                              22⤵
                                                PID:2128
                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                  23⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4060
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                    24⤵
                                                      PID:4804
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                        25⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:852
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                          26⤵
                                                          • Executes a command shell one-liner
                                                          PID:1196
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                            27⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:6004
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                              28⤵
                                                                PID:3652
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                  29⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5444
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                    30⤵
                                                                      PID:3252
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                        31⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:2044
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                          32⤵
                                                                            PID:3520
                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                              33⤵
                                                                                PID:3444
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                  34⤵
                                                                                  • Executes a command shell one-liner
                                                                                  PID:6040
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                    35⤵
                                                                                      PID:2216
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                        36⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:2676
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                          37⤵
                                                                                            PID:5956
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                              38⤵
                                                                                                PID:1540
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                  39⤵
                                                                                                    PID:5068
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                      40⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2516
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                        41⤵
                                                                                                          PID:996
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                            42⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1844
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                              43⤵
                                                                                                                PID:2020
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                  44⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4716
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                    45⤵
                                                                                                                      PID:5108
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                        46⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        PID:4340
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                          47⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1628
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                            48⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:5656
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                              49⤵
                                                                                                                                PID:260
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                  50⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:4520
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                    51⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:3676
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                      52⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:5224
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                        53⤵
                                                                                                                                          PID:6108
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                            54⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3472
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                              55⤵
                                                                                                                                                PID:4092
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                  56⤵
                                                                                                                                                    PID:3180
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                      57⤵
                                                                                                                                                        PID:3640
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                          58⤵
                                                                                                                                                            PID:2840
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                              59⤵
                                                                                                                                                                PID:4948
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                  60⤵
                                                                                                                                                                    PID:3080
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                      61⤵
                                                                                                                                                                        PID:4876
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                          62⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:3752
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                            63⤵
                                                                                                                                                                              PID:3672
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                64⤵
                                                                                                                                                                                  PID:5128
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    65⤵
                                                                                                                                                                                      PID:400
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                      65⤵
                                                                                                                                                                                        PID:5488
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                          66⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:4684
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                            67⤵
                                                                                                                                                                                              PID:5440
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                68⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5792
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:1328
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:4048
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:3400
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                          PID:5832
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                              PID:2508
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                  PID:3908
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:3616
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:5624
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                          PID:3560
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:5524
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                PID:5296
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:4616
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                      PID:4512
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                          PID:2716
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                              PID:692
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                  PID:5764
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                      PID:5648
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:1352
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1216
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                PID:2420
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:3664
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:6088
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:4472
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                              PID:2932
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                  PID:5476
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:620
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:2480
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                              PID:4432
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                  PID:2276
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                      PID:5892
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                                                                                        PID:1932
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:2112
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:2348
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:5864
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                                                                                  PID:1128
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:3268
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                        PID:5672
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:2040
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                              PID:2808
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:5024
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:5868
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                          PID:3392
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                    PID:812
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:2464
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3864
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1004
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4408
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:1712
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1064
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:3116
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4468
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:4244
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1108
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1824
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2308
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock"
                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3156
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SOkYoQks.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZGIsQoUQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hSQQgQAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DgQIMAgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QkkkAUkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kEAEkkMY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:432
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SsoAwAUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OcMwIUcE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jAkksMsM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DeokAwMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LYUYsYQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3864
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GOcwsIMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CeMcIYkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGEkMAog.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pqgwsgsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BOIoUoQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HoYgQkYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FkYwoMEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UyAMkkcg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\icUcEgEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UusgcEAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BmskAggU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vuMcowkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DQQcUUYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vMUcIokE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gaoEEYMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:992
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qWAQckko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3728
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:200
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sUEQkAIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hAEAEcAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:616
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LecskIAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                                72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pGQwQIEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:620
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KgYIkkIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\okwQIowo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wkkUUIYk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        PID:812
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FGIMYwwU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3156
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VqAUwcMQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4048
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WIgEsMUo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QYIgcAcQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GSoQwkMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XaEEIcoU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:812
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KmUUMgwI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:824
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sMEYwwsg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rGcogUMA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3728
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fWoAkIQU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2956
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:3392
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NqowQIkw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5632
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              PID:3116
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                41⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1976
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                  41⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KaMIUIAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2660
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                  38⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EIIMEMAc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                  38⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:764
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                    39⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3792
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                              PID:248
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4728
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                                PID:2544
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SaUQYQYA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                  37⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:620
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                            PID:4456
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:4492
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              35⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3120
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                              PID:2804
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nMsQoYwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:4304
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                                35⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                                PID:1420
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                          PID:2252
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                          PID:2344
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                          PID:6116
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lKIMAIgc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                            33⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                            PID:1908
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                      PID:4480
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:1572
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                      PID:1696
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IGMgMows.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:4944
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:3712
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:3672
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5220
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wAEUAYQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    28⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4168
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        29⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        PID:2976
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:4520
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5832
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                    PID:2852
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wEAkIMIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4416
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5656
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:3180
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:4780
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BsIEMcso.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    25⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:4048
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:572
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3800
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                  23⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4292
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dSQEMcQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6044
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                      23⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1852
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                                  PID:2772
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                  PID:2020
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fEMoYowM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:3444
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:788
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5848
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:1976
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MIEwMUIk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3364
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                    19⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:2800
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                              PID:1352
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yqYssswk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                              PID:4888
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                                PID:3068
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4864
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4084
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:2676
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SkkYMIgw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                            PID:3380
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                              PID:400
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                        PID:3832
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:3316
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                        PID:972
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DacosoAk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                        PID:3420
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                          PID:3120
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                    PID:968
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                    PID:4292
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                    PID:1240
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PUgIAYEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                    PID:4260
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                      PID:1108
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:5400
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:1836
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                PID:5920
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TcoIsQsM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:4456
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:4320
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2516
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                                                              PID:3020
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eiAIgAsk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                              PID:4788
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:4200
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                          PID:5672
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                          PID:1216
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                                                                                          PID:1572
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WuIcwIsA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                            PID:1100
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:4656
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                      PID:4584
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                      PID:2892
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zUMIYQYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock.exe""
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                      PID:1188
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                                                                                                                                                                                        PID:4836
                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\NycYMEgU\bEUEsAgE.exe
                                                                                                                                                                                                                                                                                                                                                    C:\ProgramData\NycYMEgU\bEUEsAgE.exe
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                    PID:4404
                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\JwYwgIIs\EswkAYUY.exe
                                                                                                                                                                                                                                                                                                                                                    C:\ProgramData\JwYwgIIs\EswkAYUY.exe
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                    PID:5548
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\CwwosgYc\BYYUwAMo.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\CwwosgYc\BYYUwAMo.exe"
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                      PID:1392
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\CwwosgYc\BYYUwAMo.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\CwwosgYc\BYYUwAMo.exe
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                    PID:1200
                                                                                                                                                                                                                                                                                                                                                    • C:\ProgramData\JwYwgIIs\EswkAYUY.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\ProgramData\JwYwgIIs\EswkAYUY.exe"
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                      PID:712
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4428

                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                                                                                                                          Visual Basic

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1059.005

                                                                                                                                                                                                                                                                                                                                                          Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1059.003

                                                                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                          Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1548

                                                                                                                                                                                                                                                                                                                                                          Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1548.002

                                                                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                                                                          Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1548

                                                                                                                                                                                                                                                                                                                                                          Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1548.002

                                                                                                                                                                                                                                                                                                                                                          Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1564

                                                                                                                                                                                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1564.001

                                                                                                                                                                                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1562

                                                                                                                                                                                                                                                                                                                                                          Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1562.001

                                                                                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                                                                          Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1555

                                                                                                                                                                                                                                                                                                                                                          Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1555.003

                                                                                                                                                                                                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1552

                                                                                                                                                                                                                                                                                                                                                          Credentials In Files

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1552.001

                                                                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 91bce9bfda3c882745688d0011eb8f0bf06ecc4e9092ad15a66435ca2e2f64f9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 42a09f0a595bd0187e4d402059bcfcfb4d7ede034d69466747a7d7802dff702e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 24fe280fe0bc7ec7d83d3c2003e91af1c1001d55f73920da64eb5180cfbb98fc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 76b3b956b7ad8bb32bc0dc965ac81a9439cafb3f3c4c0f6ab4921f51daea3263
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 fda7bd615e56b12f18e6a698c56a584a130354d525c34bd5f062915295adb504
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 be45bf22dc58e360d1a14c6596773ae89255835b6d859ee5ec07aad4bb408131
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8219dc32c229b7955f36cc01cf71751b8fb80c4c38538d39fc604313a3283034
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2d0efc3988a0097f41be511c492c074b0d6ce7c68c58d5a9fe59578f344b88bc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4519e0aa0466bf965ff381ab5fd548e0eca4d95195b0358b3cf9573400f9cac0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0b4749a2f5b596358824820e74af6b599c2044cae360a1cd1eef6f4333038877
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2faf79324b2497cb95b346a71d7d5c5ff21f2478c02feb0759ed3dcb6a500185
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 333d3917228bbb96e43287be55b750e68e2a338cfa3e4f93dc7723b9a7f94741
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1fa06abb2f071742c112557323c37e241a410348c45cfd55abe9c8c5a7689ef9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 29f627ce6af9acc0e93d596f16f84a1ebb149cbdd787a75720ee06a147c9911a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 96098071381f06f0a828c83a5bf14104646ca1d44b490b0a48df5b9567ef5ad8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 55853871ca3a5e51faef43876e5ce7bbdaef408c69885e6ca4f9822d5fa9a42e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f6ebb12c73468ef21c9c0b6bee1faa70e7ea7248cfa306355a0a69b21b0f1788
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 592aa85dabb42f4745c579080c2e0316acd8f2ba5c1d7f2bddfb073084800c89
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3bb66a3c8aba8015b01f57a19d4c20a7d63f501ae7f7228076edbf82fbe9493a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 813fb966507583d8471e3c36c537d22ac9f0d3da1332fe940114e594d8ca7882
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f454521447949b21f7140db33d9e32962cb1636cc30a1be0ab116946029344bd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ca8cd680dc64799ab8b91e663ec8cedafad1154ddf83bb09124ee540407a2779
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 911479ee7a229c23d71e5e38dc5a5dc1d13498513ee9110227a674398721b579
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 10106d70a5593325d1452800a3f40aa6f75216c0809128f59234fa7fe242ddcd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d86c05d25d3b715b3d362e823b495980d469e393b2b6c6dbcc63122c23ca4928
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 dd6de01b9d641fc802d9b9737f371fe0b9ec2d72de1a5a5b0dca4c9ca61736f6
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 981dd94be305f8d7562b6507e756ecde575cac18437ec0279e0d819973dcf8ff
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 20fb6b224565ee6e2e1371141c28490db5d2aef7863d641676625c4bb5e02128
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 71b03e23a4c3ee5295a08c7188240d79e4eb588a5b14b46419e5d43e06666f71
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 06f6aa1d0bd1c25acd8bc5f0d55771dd9e8a9420572ceb2c4394c756f9e65431
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\JwYwgIIs\EswkAYUY.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5a055d7a9948cda418b9b380cf75afcb7bf02ed29c258a219b5aa8945351dd36
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          bEUEsAgE.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\NycYMEgU\bEUEsAgE.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4abdb1df818a3cc50a92df2986cafe73ccae1aa474dde15023b9484d6e4f1ec8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          wcks.txt
                                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\wcks.txt
                                                                                                                                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-07-17_373b267751718f4e35fe700af94f4b8a_elex_virlock
                                                                                                                                                                                                                                                                                                                                                          • Size 7KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0ffe0281a499e5194eda53f4c14ae0819e712d582cfdfddd5d8802159b4747d4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          AUIe.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AUIe.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.5MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 50679f8fc76fcf2116e15b0f846e25492153ae2b6318342d8b73f5dc06df8015
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          AYQK.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AYQK.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1ff0adc5419d8ac923aa8a573bd11eb92aaa82d2bd84db34336756619dc04104
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          AcMm.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AcMm.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7fae8c2a2455a90c25454a1b9a43d4ae8d8eae42134fcc8145def30dde98d81c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Akcu.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Akcu.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3e9562990031cc8801fd981e6bc381736c991ce2e61f79e818858cf290beefdb
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Asge.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Asge.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d57f7cc389a327839d2896bee814223b094f4ca6b47c6359c95742f3d540c6e3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          CAMG.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CAMG.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 69c06026ad9bdc2215a15a48f298a66b744ddbfe48dcac8dc90c7d5121de940f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          CAsW.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CAsW.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 71449b2b4057ded8da6b31b8df0e46fb4091ca6d306cc9ea5e380f2fd3ba3ea2
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          CUgk.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CUgk.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 de66a1a2e1d66c61b900beebcd3a761f5ec5301c7bc6673cf647e7f2c7f333ed
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          CYQo.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CYQo.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c9ad20310669a2f02b0da3fc621aa4895b9be1c565a0accac86b65bc1ff2901e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          CckC.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CckC.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e5e211e84e1cf7aabb8a902706bd601fc50e1a4241824681d45ee129e01c88b4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          CggC.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CggC.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 3.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1ee75dd3bc431908a07e7e0579066fede0bcbc68681e077be9ba988716802956
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          CwQo.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\CwQo.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 09d7409a1bc9fe6b6e6e282e1d789c4d4e7e7970a11e56d466e9b38991014b86
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EQEc.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EQEc.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 38667f4853a5407ef02ab22ff7871a73877aaf26273c0c1e90cb17152ef9a5db
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EYgm.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EYgm.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5094d31fb5ac9e5ff840fcfb6b9d7c7c77627f0ed4644fb22187d8198c5171b4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Ecwo.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Ecwo.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 791da8fdbfc0d5f0c580c00b2108449489285fae0536c836d4b1380e609315e4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Egku.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Egku.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6356f269a4f7d550d3bf429715aea7a3c2f272176cd5d68fe960cd01855e9dc3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EkQO.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EkQO.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c9f836ee243f931c9c913024d2e86945c9068e7ceaecd0d9f78df97fea23fd34
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EkYq.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EkYq.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6c9cf8ba5ab6dbb738cfe9e26cb300cb3f8d0aabee0cdaac5be379cabffd37cf
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          EwQw.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\EwQw.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8f3c52d0ac392b4c5a037c83c887ee9095321b7ff4bcf60950042db23d28d133
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          GEUM.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GEUM.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c35d199f2d1965d7f4dea3c99412e7ed2aea8ad38ebbb2f7557720581f416d0f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          GEcy.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GEcy.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 eb9449983ddc2c288fab60b27596acc0c6e77037a98ef78987cc7b99a75e43b3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          GEgg.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GEgg.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 944efc5f721335944717021969b792475024abd8d7e918627f3ede760b3031dc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          GUcY.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GUcY.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 52bf93304a776cd5a6616a411af6eb4c34e60a92795a150ee5cf8a4e61304841
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          GUcc.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GUcc.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 383e0caef8f9bed3a75ba89930c6c12167d86d0914126465ec6d60c8618053e8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          GcMU.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GcMU.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0688e3221d7770bea285e554c4b9c94092d68fa66eb141a7458f531a141b322f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          GcUs.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GcUs.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6d7fc834458f02bccb3f2cf7ccc69f771357e00008a2f980fb33ccaa05bd9ac2
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          GokA.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GokA.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          IQEE.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IQEE.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 fba4c20c0cbac9bd6cf1e90cc21c043fa0b2b79aa2c82d937be0db9a2e8ae7be
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          IUos.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IUos.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          IYci.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IYci.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 61fad39d6eb2f0a676ff85116b90d29cfe519b45df6de5508a76292b96338718
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          IwIw.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\IwIw.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          KAsU.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KAsU.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 06ecbf75e209d8fc0f3a1e22eed136ba57f99ea59da1818a6d04d11add19c1b4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          KMMW.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KMMW.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c416ee37044f994a2a13b4004840cbe6fd9ceb15bebe3f419e8f71960f103cc4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          KQwa.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KQwa.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f6e34d7bcc048bd8864f1a9e4d070d91504fed5d722d39034b5d0c85fe46303a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Kkom.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Kkom.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 186c465a0b8c2bc0bad5ab0ff6df25dd9b51417fbcc9a1c8221c5bfdb83ecdb8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          KoEy.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KoEy.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 79aadb5a86b3156d6eb580a1432d6d4b60318b47a8ec79938e2c86c050e8d0db
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          KokK.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KokK.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5282e9e642936a7b3cb999b227b25df88e023d381038ed442e7932682409a8ba
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          KsIo.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\KsIo.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b68571fed7639f179665a5ae6355d72c4fd07eee6d2a16ada708ed78904a88d2
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          MEoq.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MEoq.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5b5d4e2e38602c2b9703f55c57b8e6efa44b4f119946afb949b9952f0d26c5f7
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          MIAi.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MIAi.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7e389c1193498f4928dfae948c264c4f7af8d88fd8473c6aabc3f5687332ce79
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          MooI.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MooI.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0d8bc49f369e17862fd000a36a75e7ed25376e5d0ffd6d0215e364de6449a194
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          OIgu.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OIgu.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a6f6f159683247b061c5155caf8d2327b3305a355b12c919bfe2598220554bd2
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          OQAU.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OQAU.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c5f951ac1927a3f538820ed32459d1e857f581642462133fac5dc626e129791d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Oksu.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Oksu.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1d46c6f320c0bb7365e684165fae51771fa1b5174362e1789fbe48d42255547f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          OoEQ.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OoEQ.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d5e7820bea3197225f60706d4a5c4b12b6d591a4f099d04fce14c4f64f642d34
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          OwsI.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\OwsI.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6dcdf8fd77c7d3c4a2baf3bf734ecaccfaa981c0dad547ad3aa637516d02e4e0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          QEoK.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QEoK.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6f0eea75804f2d997c72098df9e27f62673a103404622ebfa1495d7a046245f4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          QIQs.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QIQs.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d9475c179e529d307f0cdab10fddadc2d89f35cf877220fd94c558a6835ee963
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          QQIk.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QQIk.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 65c6da32078973c896756d5fad3f305c36281b891fed1f6e95687bf1d47b9794
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          QYMU.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QYMU.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4a57f0776f8702c76e722715aa3bb5da5410db84b7e81e14d4563ae96ddd5fd2
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Qocs.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Qocs.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 529982ebdd3ec1989aa260a3c098b02c3be9ac21b6e03aa2610c2fe1e640eda4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          QswI.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\QswI.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Qswc.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Qswc.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 247ee891255b655d3656ae181db8462c0e77b4369b7926e015af3307b099ef17
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          SUEC.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\SUEC.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4f4a523ac7f62d3828cbb9767244dec12861bf1c6391de61da6b5a69086dcf1c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ScoA.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ScoA.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d2122ec069c02b3a419e640ff6d3dca6fcb801744926c4785b2f928065b4c791
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          SoMk.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\SoMk.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 531111a608ca449281c3648e4c7a41a01e5cce7f1b05632a9d22516953a57fe3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Sowa.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Sowa.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 828c9c8ef64a8cbde472c1fb9e7d5df2474216a5e05fb039031e3f36ac63818c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          UMks.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UMks.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 32f19c4886e593bfb85aaa6c3e1687dd959b5406d9d9fb8d06a2c048dc77468d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          UQAe.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UQAe.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 85f4b185262a302ed8210ff1a7cf04129041f3771ef1a32d62b59f3da14a8971
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          UwAy.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\UwAy.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8026f6445bfbddee9a45a01c38949d4d6b3a0a788dead6f42b3590d04d22e748
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          WAQU.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WAQU.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 11f05905ee93acbd77b3173d932bfd51beb0181333f3e3bf476635d3718386d4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          WEoq.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WEoq.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ecf39ef852e18ba81badd1cb2cb641a6fb360193184a1bf72af1ec82d06d1965
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          WYIc.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WYIc.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e634d4358be7ddf9dc2ce44298c46f89cae7d635c50e17071286ca50e0bc5a87
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          WuIcwIsA.bat
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\WuIcwIsA.bat
                                                                                                                                                                                                                                                                                                                                                          • Size 112B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          YEcW.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YEcW.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 bc98a1c581419a162d77cdfb16a29d937b02cbb5c85055b5f22a85e3620d862c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          YGUY.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YGUY.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          YQEs.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YQEs.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 73d404d3422b9ac1145ceac057980160f0ea465110513afd0af0e818ca205089
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          YQUW.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YQUW.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 da8315aa5646012413a7fafdf3cee58453a6229c88fd44cbda756e1f651f2ea9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          YUwe.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YUwe.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 3.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 eab4e7a215f9d4fd66c1b9ca5b3dc5e506fa2a97c43820b11bfc394048f662f7
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Ygca.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Ygca.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0ca307cadcb1519a23a8a27161bd86d91d67c7b191a50d3f1dabb2595a95190e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          YggK.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YggK.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9fa83d6676962adfce31d1eefde8fe145de1dc8875435d897675506d611b64fb
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          YsYa.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YsYa.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 eb4a7de3c01dabbf974274b3bae3d920633a27bc044b904156501f1a81768fae
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          YwIY.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\YwIY.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3ca7a265dd13e19581634cb8b96389eeb8219a081cf2ac9c540d17cc156df4d0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          aIMM.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aIMM.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 47e7bf28c80871bf2eaa00f24fec82eb9fd2ce03b4f7e3a310a00d858ede77e7
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          aIYI.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aIYI.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          aYge.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\aYge.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c1e012228e75d287930a13591c952760bfc3b18889f5c835c553167436180383
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          cEII.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cEII.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ckMk.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ckMk.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b55cedc62a9364363137d0de56214573ed5a0184ad240ad7fb7caa678dc78ebf
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          csQw.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\csQw.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 bfc542598dbf4507c9f35741c132a27ff6154d0dd8267b25999d0cd0db58b876
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          eQII.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eQII.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f548b690deae0c2ee5bba3c539beb60e7adb0232257601a3e1e36ed7f70c838e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          eQYQ.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eQYQ.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e1e95bf0be1fc6e11e639443a5235da48ecdcd1b0bd37f143e185caf246e4537
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          eSMU.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eSMU.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          eUwo.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\eUwo.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 500c2a1805f36a84516b6ea81cd1a8fbf09ad60f76043f8c474d7ba9f2739158
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          egcU.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\egcU.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 fc8a399e98f4501ec178480bb55ee41260af4ec09fcc43f6e73b219d0c4d5f43
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          essK.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\essK.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f936c022d04b1e1afe1f28f0c9596772952b957f7c9e6f22641929c54125ed64
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          essK.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\essK.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4700b372f05e535369fbbbbaf9abfe26037e419e94bbef89038debf8929c446f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          file.vbs
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                                                                                                                                                                                                                                                                                          • Size 19B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          gAME.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gAME.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ce9672d9d63ac7575c7ddbfeea1c147b7f6dca693acb8a24463881db23ab8c9e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          gMAC.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gMAC.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b126798b554539d0ad8228a1e691f07cae3bafe18baa0210776bfeb9d2e11360
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          gUcO.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gUcO.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 571d85605d82d4f50b65c2964b8e8f37f2776e13b5c8f562692b8a0089c3695c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          gUkk.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gUkk.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1ceedf9c8026f7733c0518bbed93f2eb99a93bc4c3d1145ce7d384a01c62cf21
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          goMy.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\goMy.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2799717dd044fe6aaf06f18c27f906f1f876d5dc32c9eee101764af217e4e3cd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          gwMA.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\gwMA.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 05b28f91164f6db6f570409fbed9b7e48460989afe15ebede16a65748a35a192
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          iGgY.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iGgY.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          iIAM.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iIAM.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8ee5fb96dc9c9760f5981fc6c05c75df64a4106547d357eeec5324d493fde1b8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          iMIo.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iMIo.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f7a5394195532d6ee165bd2d1ad658b57fda8083a6f96df1af3680c361fe74e9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          iMsG.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iMsG.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 75d058be606f58e1939436c703c743eda936b81893484920ea276f586278c6ab
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          iUEE.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iUEE.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d3e9af6ba1f6233c29b3fb6e922f4bb129f0365329711f43e21f653aee26dfe7
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          iUce.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\iUce.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6f4d7d3b91196af352b58540ec03415bac07d3e7bbecd338d097c5f21ad5fc8e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          isoy.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\isoy.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5a2b0e1c7ca46eb0153c49bdfa0fec6460b0f62f3ac15ad72812da80652652cc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          kMgC.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kMgC.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5726d2cefa6572760257f826a6ff5b8a38f4d69c2e113c2ec802a6d74d0f2959
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          kUQm.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kUQm.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0e1e268e1ddecfd1e77baee9123e1c4fdf31448cd6190c7d0bbff73679e8a059
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          kYIE.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kYIE.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1ebb55dbab155ce39bfa6f4d1fe60cbcb1b144bb55a8a7dc4b16b214a7ba6e0b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          kgMW.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kgMW.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3951cd8607376cdfe1f80626173de19bee3eb2ec007351d8732e8d4c6cb4d81f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          kgYm.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kgYm.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 bbcb26734006e941a7c5d67412ff6b078f0a553292c9fef995cd0eb122b0b4b3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          kkUy.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kkUy.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8b0b471ed1e0296b07b658a09ce60bac79b09719ac4dca5d38e31fd61e0cdcb9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          kkoy.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kkoy.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d23b746c575aab36dd79778c5b509e4e7c089bd446409e95ca51f7810e64a86c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          kokC.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kokC.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 40f3e29f3b63989b3114a4fb3a6983186b0d74113609690611d62800afd77956
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ksUO.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ksUO.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7eb701ddfc05deec939221e2e6c5277133557de52d4cfd8705a0103b9b987d4c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          mUsk.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mUsk.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 351cab442849e3d89fd65a6a766cba43c88f6e65f4035a34d67d7962507d6aed
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          mYYy.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mYYy.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7134a4818ea64b1f02ed036087e48f4f8a24c8b0424f57af6eb577e7da3239bc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          mgoE.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mgoE.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b4dcbf3346a06ec69a968f1dd7a5d29084c838d269ac33884642c8424649b3a6
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          mksA.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mksA.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 bca48a9c082e12877457bdc77614bfb8914849f718c7def21bfafcf33ba1b83d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          mwUW.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\mwUW.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 245df2328c0d4529480598d83ae342d34f32a8d89019b7d358fd6fe97bbd43a4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          oCcE.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\oCcE.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          oEwi.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\oEwi.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0014d05a93a0afa26b7881149415b0463cc08ae6947d7c6a73b52b59eb9d052e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          oUsY.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\oUsY.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e92726e28df0b173b9a93c79659b70f8a75966502de71f6f4b4341416aaacfc1
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          osYG.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\osYG.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 bae81f1eb08c5e6511cd8d017845cbfccdcaca45c5e51d9f7648037a61eb2238
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          qIYK.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qIYK.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6f6534ea7eea63951ecc5a4a82bbf0626bb06451446be3f05359f671c2d96f38
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          qggM.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\qggM.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 070adf4c85a5c51c67dd273ce1be6ced474d19e89e110c29e20e050faf10330d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          sYMq.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\sYMq.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7b32f8cdd59b7b953d44f36454fbc90372fbe76462b610c9ad79a9628d74ccb9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          scYM.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scYM.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 55b169d69d16b4b006d12bb653015227094dce127e6c0b52f020d33475a4ba28
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          skQU.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\skQU.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f942daf4b7e32a7342105a0d8f9fe2f06d679de8d1f76436ff807adef9662ea8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          skUE.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\skUE.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e2bc4a47f6791bb89fdfa8f34c7858be9b8498f35faa0f7ce6d4ca0d0a6c3b9c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          skcg.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\skcg.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 599c216431eb558a9e2ae2fd573b7527050cedf46d8813a08d41ed907c40fd28
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          smYg.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\smYg.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          uAsa.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\uAsa.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 dff6c790776372a20288538c9ecb44078f22bde3cc2866f9eb72c57675749773
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          uIMy.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\uIMy.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b5297fe2556b6f43d127a5ce4835f2cbeb9a8ac188eb0d704256466dd0f66a9d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ugMA.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ugMA.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8b769ecd5f2eb95684ee78f47405fc1555137f6261e1b6585abc6ccb12f0da0a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ugww.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ugww.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e49395ff3fc99454aff532fd785c0d190a024eb5f038fa4eacb6b41fa61d259f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          uooG.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\uooG.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a0af5bc3e2a80fe9532785476d1efa79bfe3c3d5c69858b6c02f49be7eb7f285
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          wEwM.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wEwM.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2700a56ffa354de441490ca6b23a92eb484f6cd86f6e83c687a7bb3d42e1d83c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          wMYm.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wMYm.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5d8c1c1988c3091e568c473029924d06c73873f485604fbfec0ac13948e88f1c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          wYsm.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wYsm.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 dd894ce63306f39009c54573c03c4326097ceee293cadaf246e97357992d9f79
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          wkse.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\wkse.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.4MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9298256b7a05bfec4d9cecab6337901a09483ed9f6478fd8a2c1d0f4e147d9a0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          yEMY.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yEMY.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8a158686994e7627a3289e51d40268e9160e48cf0f08d0b07e745d4bb4780210
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          yIcc.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yIcc.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 20cd11330ab497ef394512d68cfc4552d0e77cce654b637faf37c6caf3b4ef53
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          yMIQ.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yMIQ.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 fe961a6724d9ccea778b38986f5dfea20343823c32b734f420b98d7cef652cbe
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          yUIO.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\yUIO.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e69aaf6f6cd1fd4f268a12120327997c95769770ef8cc70c3c2bc9d96a0b60c8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ycYg.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ycYg.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 71254090503179540435a1283d04301f3d5ba48855ae8c361d4ac86e3abd2865
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ysUu.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ysUu.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6ab5fa23ab924f9f21fd88bbc2a85cea7e9f211960e850ff413d6c06a7850b43
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ywEQ.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ywEQ.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d88ac53e28ae3d4046298d41a8fa546e616621bb7229619e45fd211ffe44aea5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ywYq.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ywYq.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f7bf974df3dd599c9c2bc56484a9ac71c36e4324f5543616f57afafb43e95062
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a73752606f588bd422a8842c00015eb12affab8c254769dba50af96e86704281
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9f013f257f30e4919eb2c0256c1c2f9f7a1885c7fa35897e25aee5276a061c34
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d175fdc5c6c02173d9c917a27e638ec84358081fbaec6a40417d288ce5c536e0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7d782adc46cea13bf04ccd296acfae5791ab77eece77753f8500e4fb4089516f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 691cea5e0cd2909d33e43429f38d004a6f4283a2fa0fe70af94271cfd7cdf084
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 28ea47e48601c36b45b5b56c2c2e8ac88bb8c9cae193e8a547dae6c6ea681e1c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6c02e7b84fa3e3d0f1de04a39e534d85ea3ce2b643a839ab79cf68e03798a99f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f8dd0f6712b2da3228d7ff1f266b20561b009aa7fd6c4e686be95906f4b98d97
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 babd5eb63774bfe562b10c022f0e18fc5195de0618f9897fd82b222dae218cfc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 96157eda1df05bf80491d947c056af37f89c45bf4e80b01a11734ad5ead1287e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 387273dfacea3fd591b7d2d5841dac402c31720a5b580b96cc47199c656a56cd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b9ca7e06a1031f29f4aea59e9c9804f9dc7c45a3e2e25b9b20fa3036df98376b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2f011a7b63c4969349f3c510ce3ca4bba8a69a5ffb6914c23c969486b4eed6de
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 484a982275b7f962229c1b65e7122e7e9f707193d0e4583eddf54b07e180de3a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 acc598d2d04ba5ce6aaad53a25a39ecbef3842d4bb1e705f4c587880e3408098
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 cf71507078a7c65e53c8715f3aa11e2278e2ab639a15ae4189fb17ac973403e4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 920501a3c8ac2ee97d266bc0a0b07dd42e5ea71e545461b13454b25b7ac66778
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3cf2c070fb2d1daa8e2c9236d8e332c5df4c6d65328930a0b0b3f51044b2fe72
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b6cd0c5b587f1869dc21bc75cea5ef38563a66085ed0860a3e601daa24ac0ad1
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e75142214ad9d65e22b94fc90fd8a0cd2695bce6a59e4f8e6d204095740bffba
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9bfa918b6e139abde65b32f5ff654cc3e9de7b153f44636e2f0f7d1cd0c9b856
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e0a54caaf2079bc3c7d1dc2c8c23d1daa51b3cb0490cfcbd19b8594d5beee056
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2dcee4632b02b8c79de7fc17a643f78da1629a91f96cab9ca256c1c5b68f6d2f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 362882bd828e8345855f6159f236b46d837cc297ae35b1116875a6a46f7407fd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2a351e09ed6a590dd4b87f50b302c361a0fafc02622f71cf1c505511f7aadb2e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 86a3f1006516fa84bbc8f8dc5875cec83bfae88f214b0788ad656adac417b0b4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c930121982b7647d35429834f33d22bf0ae7a9bd17e13a7a8bf82c0312a6d497
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2fe6beb25af830fa8a23c86424bc00e76a2e97c6568461435e0884790e315d6a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b8657e3e177f3d41b18c95802369a8ad8ec42670ba7446dbccc300b23c07f6df
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e17cd65cd1222b63a0475bffb22646d652b5bc66989ad7f0b2335a9d15324930
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b5185a3e3749355d5b2bd1d540ade60de7d3e66ea31d29101a1376f7b89836f8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f9841748c384b93b1df160a6ac80ed95e3b9ed22474e32587eb092050c0fab3c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 46fdd1e85e1b3c87ec94ff6112612cca64c0ca5af639669a97e131614acb3df0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 28098fbd9f6d6008d1dc04ed9a4df6d81b1462480cc871377085e331ca741e0b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2b43542cf04807e438b1fe0db261b7729b7279a71fad3bd1b25445ed875f4ef7
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3751ecb8e8f86df45b83f327bd53935784086ada76322d979d90087b90e69b56
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 25a756d76b2d3dc2852246d2360b08c510e1712417d90b1ce335c46767b2e870
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7fd1f369f4fc423c90495e38a0d13c687a16b74ba75cb6a6e658277d8e52f99f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 bd2d6a61bccbbc97b650f8a9261e5bf1adc196ee6601f348daaba6a2056a5366
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 47eccd75f4f7e9b3819390c2b19b7abdf9f3082b0fe1916bc7c6fa8eb6a64a46
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b25aa215b25ac0cc6cbca6743848a27823af838067ddbd70562256822570a83d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5275d5ff66e77e83dcf4ad0eb7675c2aeb7103858c09f8fbd8b1e423c8928191
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 aed17dbcd8629c3efb3111231c0f897458abd9b3414b46b0fe051252f260e438
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f6fd3f26c0fe8092698077c763899e4125a034cc49d8a7f9733718c3d57ba428
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5f2ada2bb0629dc1b61d09839de36bb9dd6556a6f4bbdf51e4175acf0d4a02dd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 301b0e38cf484fe6eee882ad4226bdcb3bee1bf3a92d1b624435ea45ac7dbada
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 870829a9d572a9988ce4796d880005f0c7f1f83025a5b5bae711788bf8cd9f73
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5f096a6e5f5c2da96fd0bc79ce97533b18b12e7768742d8e48cb8adbe74d93fe
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5842b26d43b2b5896abc214c347341be72547ea3e56e4c873b2e3f4663ad8b77
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5b768fb44b25f5a2a165b03759a2f10da16cb8f2a7c9726f9edb1cc3a510b84e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d3b010655da4ea23ce042a16f9695fe7100c667c90294a6da4be7d1f70031dac
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2e55e9a3a3891b0a041742e2532491534eec7e46eaa993103249adefac5a60d0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0b458fa3b678cf81b920177fb49b3349b67dc0c1413ed988dc632289551c2270
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 047ed65c24624f227cab4ff117fc70a7be18fce78f116b81cf3ebd1747bf5e51
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a9fe2134dde5bb48c9ccd403e09774c749d6de3df4aaae38ce87714a965b24f7
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 52ff8c08a893c1872daeca0602e8e30dbf8bd7cb5c5c9456ba23fbb6d9cb2b84
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5891d29846c024a3bba407a32ce997f3af3573c2b3aec5cd099a9b3ed20fee30
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 bffb40efe782d2369b8a6a6817dc1fc34cedc64dd48d9fb0c87d72f6412217ad
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 041846312f6ddcb0c07d3f718efe57749cc87dbe6c5d2216ceb8ec80d4e178a0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 69c4d03645d99982f37897177e4a9f9a56dbf1a0de9014868fc70a12067d4976
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 af4b40e527f58085421390725fb34159fbd6f57c9d5f060c09688060412fff9a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5e64c6d32d2c35a360455bd037bd930a6b01e9b490e70dbdc0a07f0b486b83a0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5e109cda6c568e5b00dc1cbc2fbf714d782249d1ee6af7fda73f5735abc81700
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2e667b5409bfc372fdb7afc768d74ddfe2cf6f5aa77ba4da984df6a5f2db9a61
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 870128759a887024937348c3c4eb6e63c963144da2bd188f75e95e277503817b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d344e4dcaed14edb275f2bf151cbdaa143f9bbac9883eda1a08cc784ae6f77ab
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5d688ff4b7f79b4bb4d6c3b5a2724e0bd01927bd71da92f16557c14cac450b8c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 62cb30f58083a731289cfa15002c8aca88ad50fb38daae3b26805b13a8df2e6b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 13a4ef77cc08e4fafd9460c9bbc654a91fc65e4b45f7fc6f7dde2849ef4a973e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 aa562dafca3f1fac57a04967feceefe202d17c8c8b8b51c9f757d866cb2788b1
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5f93b2b3923975cc80061efd1cb46f37975b283628815466ae13f38b1fa7fbff
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 63259073937f856f813826b873a39486189697ce0e44eaa69370af9c07eea0b5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ec541d3b561fac2b3c817d95af3dad5dfa05bfc75874d61534734f6ada6b34de
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 76ee7baca3453018f741e7230f854679570ecb463753be3bb79afe9e4a2cc6a8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5879f858f5e975b0759d10ca5b3c5e0cf9f857e6ba9ee2d37ca323a354c2bf00
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e7731b88096a9a8079c93c64d71dcb49b6c8baebe3e0f7902216b0bc627b7560
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5b88ae0a34e1eac6d14c0ceb14f947d2475b02c097d7259142e0423f668a70a6
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 be675ae3e616887f918143517962e2ce525447f7fe8c9db655bb0c4ee314caf5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 31a051ebef88fa87f276a7cdffae82ef5954ae2f225bd56e49900233a82cf7f9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 07dde796b220854bd1d948fc34786b44f1c2c274f71263dddab257b0b1349ed9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 aecb871c3e505a1100c1fc71a0cc1ee01d4cfa9d1609b57fbd1d780a48c88984
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 51ed9cc32631b72f877a01fa5417fe617b950a5ca41448449e39c708dc6b6833
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3bacedf67ffd89e6eb91c7e85fc8771b19bc268f361d99043456ee482974c6ee
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0d05464e03e1c3d0a64ff97353ce53bd0f248d2bdb184477c5527c52d00b73f5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 95ee032f32ffca58e1e816fbc9ad590bef787d5312d0b4a5d9dbd344fd760755
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 31c224e81af5b685fff7483cbfed2704a6d8cc9f25625f0f1727b33e0f0b9bea
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1f26ff063d9f1b3b6c8dd11fef5bed63799331959150f93fe7981bc1c0ca0bdf
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 52725af0130080215e4f3eac76989570ac7a60b912e4d56143855fdaafafe5fc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 365c4655c6e51245dd517af87e0201f01ff239931d2f45513a320d5b3b651a2d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0428de48952203a5fddb8596f43dc09cc83b081ca75528596cbbe8668be331ec
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b0e6cecc38b95df3789e9863d8f87843320cfe2e416d0ca9668911e55348ddd9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 992b82ea430cca136fb4df48b6d2a74122f2f42df34d2700e94289531a8c80ab
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 fbf631a190123eae3eb75976cc478a0434850202c09420571b4c3c124affdafb
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3eaa435f763e95035b59f44184d436791fe2af1f0fa5e5fb6d0fdb85665667af
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1271026096a149fda9bb61e27a2b15406e160c8d64d3ee729866fd566cca1a16
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b65d5930a34f53b4066aab4e2526e8fad63379278abd6edfbd025bf495b383f9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 42178796fa9e308048aa44f9916b9d4ee5a96751d6c910b7c09937bfe597e939
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\CwwosgYc\BYYUwAMo.inf
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a325f110a70560a82cdab4feea4a5c078d8de2ade8fe6f0e5d32d960259de493
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          memory/260-1433-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/692-1987-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/712-2656-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/712-1847-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/852-215-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/996-301-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/1080-109-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/1128-2110-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/1200-2389-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/1328-1905-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/1352-2007-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/1392-2673-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/1628-410-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/1700-64-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/1812-2647-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/1932-2091-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2020-310-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2044-248-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2044-233-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2200-1-0x0000000000A90000-0x0000000000AB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2200-33-0x0000000000A90000-0x0000000000AB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2200-0-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2200-32-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2216-270-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2348-2102-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2420-2021-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2508-1926-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2652-79-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2652-92-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2724-153-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/2808-2137-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3400-1916-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3444-259-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3508-45-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3560-1952-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3560-1937-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3616-1942-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3640-1832-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3672-1870-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3676-1438-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3768-180-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4060-194-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4064-2345-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4064-11-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4092-1823-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4220-2067-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4256-139-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4404-21-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4404-2363-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4432-2077-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4432-2063-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4512-1976-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4808-169-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4860-2354-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4860-17-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4864-2682-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4876-1855-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4948-1844-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4976-2027-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4976-2042-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5068-290-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5108-332-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5296-1962-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5440-1891-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5444-237-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5476-2057-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5488-1881-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5548-2372-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5648-1996-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5672-2122-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5728-125-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5860-80-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/5956-279-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/6004-226-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/6088-2031-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/6108-1814-0x0000000000400000-0x0000000000594000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download