Overview

overview

10

Static

static

3

2026-07-23...ck.exe

windows10-2004-x64

10

2026-07-23...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 02:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
  • Size 1.6MB
  • Sample260723-c7d1vafe27
  • SHA256 78d679c86f3b8de0f65912dda0ff3eeabac2d6acd08f02328997a076490aba29
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 35 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 35 IoCs
    defense_evasiontrojan
  • Renames multiple (95) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 35 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Users\Admin\IuwccsEY\eWYoggwc.exe
      "C:\Users\Admin\IuwccsEY\eWYoggwc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:2012
      • C:\ProgramData\fWAsQcIc\pEMMAIAo.exe
        "C:\ProgramData\fWAsQcIc\pEMMAIAo.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:944
    • C:\ProgramData\fWAsQcIc\pEMMAIAo.exe
      "C:\ProgramData\fWAsQcIc\pEMMAIAo.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:4848
      • C:\Users\Admin\IuwccsEY\eWYoggwc.exe
        "C:\Users\Admin\IuwccsEY\eWYoggwc.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:4496
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5428
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:828
          • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3756
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3544
              • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1564
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3528
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4284
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:940
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1336
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4776
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:3572
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3028
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4240
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2952
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2624
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5684
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4136
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                          20⤵
                                            PID:1088
                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                              C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                              21⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:6088
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                22⤵
                                                • Executes a command shell one-liner
                                                • System Location Discovery: System Language Discovery
                                                PID:3656
                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                  23⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:908
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                    24⤵
                                                    • Executes a command shell one-liner
                                                    PID:5396
                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                      25⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1372
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                        26⤵
                                                        • Executes a command shell one-liner
                                                        PID:248
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                          27⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4952
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                            28⤵
                                                            • Executes a command shell one-liner
                                                            PID:5996
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                              29⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1412
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                30⤵
                                                                • Executes a command shell one-liner
                                                                PID:268
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                  31⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:6044
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                    32⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:1608
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                      33⤵
                                                                        PID:5012
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                          34⤵
                                                                          • Executes a command shell one-liner
                                                                          PID:3832
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                            35⤵
                                                                              PID:4968
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                36⤵
                                                                                • Executes a command shell one-liner
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5228
                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                  37⤵
                                                                                    PID:6080
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                      38⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:5416
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                        39⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:6100
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                          40⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5044
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                            41⤵
                                                                                              PID:4172
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                42⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:1164
                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                  43⤵
                                                                                                    PID:4332
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                      44⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2984
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                        45⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:1476
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                          46⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:4280
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                            47⤵
                                                                                                              PID:3864
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                48⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                PID:1640
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                  49⤵
                                                                                                                    PID:3248
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                      50⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:3924
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                        51⤵
                                                                                                                          PID:1124
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                            52⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4464
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                              53⤵
                                                                                                                                PID:2548
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                                  54⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3376
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                                    55⤵
                                                                                                                                      PID:3620
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                                        56⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:5776
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                                          57⤵
                                                                                                                                            PID:2148
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                                              58⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:720
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                                                59⤵
                                                                                                                                                  PID:2424
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                                                    60⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:2524
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                                                      61⤵
                                                                                                                                                        PID:5740
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                                                          62⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:3624
                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            63⤵
                                                                                                                                                              PID:5920
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                                                              63⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:5888
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                                                                64⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:3940
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                                                                  65⤵
                                                                                                                                                                    PID:3520
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                                                                      66⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:1116
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                                                                        67⤵
                                                                                                                                                                          PID:4308
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                                                                            68⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5812
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                                                                                                              69⤵
                                                                                                                                                                                PID:4596
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock"
                                                                                                                                                                                  70⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:3708
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                                  70⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:2360
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                  70⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:1544
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                  70⤵
                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                  PID:5668
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gCAgEgIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                                  70⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:5576
                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                    71⤵
                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4120
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                              68⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              PID:4496
                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                69⤵
                                                                                                                                                                                  PID:3700
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                                68⤵
                                                                                                                                                                                  PID:4632
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                                  68⤵
                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                  PID:1392
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iKEcwIAg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                                  68⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:4412
                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                    69⤵
                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                    PID:4300
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                              66⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:1416
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                              66⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:2976
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                              66⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:4112
                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                67⤵
                                                                                                                                                                                  PID:4652
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jooAswwg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                                66⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:1188
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  67⤵
                                                                                                                                                                                    PID:5680
                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                    67⤵
                                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                    PID:3216
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                              64⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              PID:760
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                              64⤵
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:3576
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                              64⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:3272
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dYAgIUEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                              64⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3400
                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                65⤵
                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                PID:4364
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                          62⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:4476
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                          62⤵
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:4520
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            63⤵
                                                                                                                                                                              PID:5368
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                            62⤵
                                                                                                                                                                            • UAC bypass
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:3740
                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              63⤵
                                                                                                                                                                                PID:2964
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jogEIAww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                              62⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:4372
                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                63⤵
                                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                PID:5132
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                          60⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:3752
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                          60⤵
                                                                                                                                                                            PID:3900
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                            60⤵
                                                                                                                                                                            • UAC bypass
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5828
                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              61⤵
                                                                                                                                                                                PID:3588
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qyswAAoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                              60⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3992
                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                61⤵
                                                                                                                                                                                  PID:1328
                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                                  61⤵
                                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                                  PID:5176
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                            58⤵
                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:3700
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                            58⤵
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:5400
                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                            58⤵
                                                                                                                                                                            • UAC bypass
                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                            PID:5436
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KsUMUAEM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                            58⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4168
                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                              59⤵
                                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                              PID:1220
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                        56⤵
                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                        PID:5552
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                        56⤵
                                                                                                                                                                          PID:5968
                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                          56⤵
                                                                                                                                                                          • UAC bypass
                                                                                                                                                                          PID:5132
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JKUYokEY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                          56⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:4296
                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                            57⤵
                                                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                            PID:4124
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                      54⤵
                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                      PID:5112
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                      54⤵
                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                      PID:5028
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                      54⤵
                                                                                                                                                                      • UAC bypass
                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                      PID:1996
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pOcMcgwM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                      54⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:1584
                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                        55⤵
                                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                        PID:2568
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                                  52⤵
                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:800
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                  52⤵
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:4212
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  52⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:4556
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JQEskoIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                  52⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:5824
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    53⤵
                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                    PID:2432
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                              50⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              PID:2360
                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                51⤵
                                                                                                                                                                  PID:5840
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                                50⤵
                                                                                                                                                                  PID:5740
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                  50⤵
                                                                                                                                                                  • UAC bypass
                                                                                                                                                                  PID:5920
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OqksYMkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                  50⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:264
                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                    51⤵
                                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                    PID:3576
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                              48⤵
                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3024
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                              48⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2684
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                              48⤵
                                                                                                                                                              • UAC bypass
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:4624
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ygUsgosM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                              48⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:5316
                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                49⤵
                                                                                                                                                                  PID:3344
                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                  49⤵
                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                  PID:2964
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                            46⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:2668
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                            46⤵
                                                                                                                                                              PID:4940
                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                47⤵
                                                                                                                                                                  PID:2572
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                                46⤵
                                                                                                                                                                • UAC bypass
                                                                                                                                                                • Modifies registry key
                                                                                                                                                                PID:2096
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qwIIswEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                                46⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:2940
                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                  47⤵
                                                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:3588
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                            44⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:2900
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                            44⤵
                                                                                                                                                              PID:5132
                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                              44⤵
                                                                                                                                                              • UAC bypass
                                                                                                                                                              PID:5056
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nqEsQoIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                              44⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4712
                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                                45⤵
                                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3772
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                          42⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:2264
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                          42⤵
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:3400
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                          42⤵
                                                                                                                                                          • UAC bypass
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:4588
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\toEMwgAU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                          42⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2692
                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            43⤵
                                                                                                                                                              PID:3388
                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                              43⤵
                                                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1416
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                        40⤵
                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                        • Modifies registry key
                                                                                                                                                        PID:3256
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                        40⤵
                                                                                                                                                        • Modifies registry key
                                                                                                                                                        PID:5528
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                        40⤵
                                                                                                                                                        • UAC bypass
                                                                                                                                                        PID:1540
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NcYsQsco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                        40⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:3032
                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                          41⤵
                                                                                                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                          PID:1936
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                    38⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:5188
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                    38⤵
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:124
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                    38⤵
                                                                                                                                                    • UAC bypass
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Modifies registry key
                                                                                                                                                    PID:5840
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aSYgAgYQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                    38⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:5592
                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      39⤵
                                                                                                                                                        PID:1708
                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                        39⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        PID:5368
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                                  36⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:2684
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                                  36⤵
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:4124
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                                  36⤵
                                                                                                                                                  • UAC bypass
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:3752
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AiYsUwYY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                                  36⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2412
                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                    37⤵
                                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                    PID:4888
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                              34⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:2940
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                              34⤵
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:2572
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                              34⤵
                                                                                                                                              • UAC bypass
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              • Modifies registry key
                                                                                                                                              PID:4636
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CqIsAUoE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                              34⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:2836
                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                                35⤵
                                                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                PID:3940
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                          32⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          PID:4652
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                          32⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3252
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                          32⤵
                                                                                                                                          • UAC bypass
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Modifies registry key
                                                                                                                                          PID:5680
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\voEosoAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                          32⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:6032
                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                            33⤵
                                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                                            PID:5728
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                      30⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:3272
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                      30⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:1996
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                      30⤵
                                                                                                                                      • UAC bypass
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:896
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xOQUsckg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                      30⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2280
                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                        31⤵
                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                        PID:5900
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                                  28⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:5824
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                                  28⤵
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:4212
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                                  28⤵
                                                                                                                                  • UAC bypass
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:4464
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VycUwkQE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                  28⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1656
                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                    29⤵
                                                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                                                    PID:1164
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                              26⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:6112
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                              26⤵
                                                                                                                              • Modifies registry key
                                                                                                                              PID:3372
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                              26⤵
                                                                                                                              • UAC bypass
                                                                                                                              PID:2036
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                27⤵
                                                                                                                                  PID:4164
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cCsYEQkQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                                26⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:5084
                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                                  27⤵
                                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                                  PID:2476
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                            24⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            PID:3604
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                            24⤵
                                                                                                                            • Modifies registry key
                                                                                                                            PID:3324
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                            24⤵
                                                                                                                            • UAC bypass
                                                                                                                            • Modifies registry key
                                                                                                                            PID:3024
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YAEcYkEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                            24⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:3128
                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                              25⤵
                                                                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                                                                              PID:1708
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                        22⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        PID:4632
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                        22⤵
                                                                                                                        • Modifies registry key
                                                                                                                        PID:3772
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                        22⤵
                                                                                                                        • UAC bypass
                                                                                                                        • Modifies registry key
                                                                                                                        PID:5920
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WCMgIcQc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                        22⤵
                                                                                                                        • Executes a command shell one-liner
                                                                                                                        PID:2496
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          23⤵
                                                                                                                            PID:5068
                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                            23⤵
                                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                                            PID:3328
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                      20⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2392
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                      20⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry key
                                                                                                                      PID:2408
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                      20⤵
                                                                                                                      • UAC bypass
                                                                                                                      • Modifies registry key
                                                                                                                      PID:2804
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kekYAsEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                      20⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:3556
                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                        21⤵
                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                        PID:5316
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                  18⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  PID:5708
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                  18⤵
                                                                                                                    PID:3272
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                    18⤵
                                                                                                                    • UAC bypass
                                                                                                                    PID:896
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RocQIcYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                    18⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:3540
                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                      19⤵
                                                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                                                      PID:3388
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                                16⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry key
                                                                                                                PID:2296
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                                16⤵
                                                                                                                • Modifies registry key
                                                                                                                PID:1364
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                                16⤵
                                                                                                                • UAC bypass
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry key
                                                                                                                PID:2692
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZaggoksU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                                16⤵
                                                                                                                • Executes a command shell one-liner
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4612
                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                  17⤵
                                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                                  PID:2548
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                            14⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Modifies registry key
                                                                                                            PID:4164
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                            14⤵
                                                                                                              PID:4476
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                              14⤵
                                                                                                              • UAC bypass
                                                                                                              • Modifies registry key
                                                                                                              PID:3344
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WGkkYYAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                              14⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2788
                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                                15⤵
                                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                                PID:3588
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                          12⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Modifies registry key
                                                                                                          PID:1328
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                          12⤵
                                                                                                          • Modifies registry key
                                                                                                          PID:1904
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                          12⤵
                                                                                                          • UAC bypass
                                                                                                          PID:4828
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AQcYQMUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                          12⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1312
                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                            13⤵
                                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                                            PID:4560
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                      10⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry key
                                                                                                      PID:5068
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                      10⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:4168
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                      10⤵
                                                                                                      • UAC bypass
                                                                                                      PID:2972
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CuscMEAg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                      10⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1180
                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                        11⤵
                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                        PID:2376
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                  8⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry key
                                                                                                  PID:2564
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                  8⤵
                                                                                                  • Modifies registry key
                                                                                                  PID:2944
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                  8⤵
                                                                                                  • UAC bypass
                                                                                                  PID:2344
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wmEYwsIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                  8⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5588
                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                    9⤵
                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2324
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                              6⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              PID:5536
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                              6⤵
                                                                                                PID:2264
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                6⤵
                                                                                                • UAC bypass
                                                                                                • Modifies registry key
                                                                                                PID:5652
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BascUsEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                                6⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:6056
                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                  7⤵
                                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1932
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                            4⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            PID:1412
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                            4⤵
                                                                                              PID:2916
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                              4⤵
                                                                                              • UAC bypass
                                                                                              • Modifies registry key
                                                                                              PID:4212
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NIUMsEkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                              4⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1732
                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                5⤵
                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                PID:4572
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                          2⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          PID:4364
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                          2⤵
                                                                                          • Modifies registry key
                                                                                          PID:5704
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                          2⤵
                                                                                          • UAC bypass
                                                                                          • Modifies registry key
                                                                                          PID:268
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qoUAksMI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock.exe""
                                                                                          2⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:252
                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                            3⤵
                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                            PID:5276
                                                                                      • C:\ProgramData\AYMAMUgk\MGggsUgU.exe
                                                                                        C:\ProgramData\AYMAMUgk\MGggsUgU.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        • Drops file in System32 directory
                                                                                        PID:4380
                                                                                      • C:\Users\Admin\IuwccsEY\eWYoggwc.exe
                                                                                        C:\Users\Admin\IuwccsEY\eWYoggwc.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        PID:2996
                                                                                        • C:\ProgramData\fWAsQcIc\pEMMAIAo.exe
                                                                                          "C:\ProgramData\fWAsQcIc\pEMMAIAo.exe"
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          PID:3036
                                                                                      • C:\ProgramData\fWAsQcIc\pEMMAIAo.exe
                                                                                        C:\ProgramData\fWAsQcIc\pEMMAIAo.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        PID:4912

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Reconnaissance

                                                                                            Resource Development

                                                                                            Initial Access

                                                                                            Execution

                                                                                            Command and Scripting Interpreter

                                                                                            2
                                                                                            T1059

                                                                                            Visual Basic

                                                                                            1
                                                                                            T1059.005

                                                                                            Windows Command Shell

                                                                                            1
                                                                                            T1059.003

                                                                                            Persistence

                                                                                            Boot or Logon Autostart Execution

                                                                                            1
                                                                                            T1547

                                                                                            Registry Run Keys / Startup Folder

                                                                                            1
                                                                                            T1547.001

                                                                                            Privilege Escalation

                                                                                            Abuse Elevation Control Mechanism

                                                                                            1
                                                                                            T1548

                                                                                            Bypass User Account Control

                                                                                            1
                                                                                            T1548.002

                                                                                            Boot or Logon Autostart Execution

                                                                                            1
                                                                                            T1547

                                                                                            Registry Run Keys / Startup Folder

                                                                                            1
                                                                                            T1547.001

                                                                                            Defense Evasion

                                                                                            Abuse Elevation Control Mechanism

                                                                                            1
                                                                                            T1548

                                                                                            Bypass User Account Control

                                                                                            1
                                                                                            T1548.002

                                                                                            Hide Artifacts

                                                                                            1
                                                                                            T1564

                                                                                            Hidden Files and Directories

                                                                                            1
                                                                                            T1564.001

                                                                                            Impair Defenses

                                                                                            1
                                                                                            T1562

                                                                                            Disable or Modify Tools

                                                                                            1
                                                                                            T1562.001

                                                                                            Modify Registry

                                                                                            4
                                                                                            T1112

                                                                                            Credential Access

                                                                                            Credentials from Password Stores

                                                                                            1
                                                                                            T1555

                                                                                            Credentials from Web Browsers

                                                                                            1
                                                                                            T1555.003

                                                                                            Unsecured Credentials

                                                                                            1
                                                                                            T1552

                                                                                            Credentials In Files

                                                                                            1
                                                                                            T1552.001

                                                                                            Discovery

                                                                                            System Information Discovery

                                                                                            1
                                                                                            T1082

                                                                                            System Location Discovery

                                                                                            1
                                                                                            T1614

                                                                                            System Language Discovery

                                                                                            1
                                                                                            T1614.001

                                                                                            Lateral Movement

                                                                                            Collection

                                                                                            Data from Local System

                                                                                            1
                                                                                            T1005

                                                                                            Command and Control

                                                                                            Exfiltration

                                                                                            Impact

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            MGggsUgU.exe
                                                                                            • Path C:\ProgramData\AYMAMUgk\MGggsUgU.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 c0c8dc6fc3e2c7d89435b229885d893a42d07c0bfe024699a34c1e47a4c4c90e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            pEMMAIAo.exe
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 c24da14d1a2582c8b502d45d8052ede813ad02e2ccb4d2997208e1770c2ce3d6
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 0d95007bccc89980bc9fd5f35cfe767b40e53bd77e83cd4cb4259f9988f3ce46
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 9df3bd8e6d1859ea868b2f3c6815a97fd395e93dda454e34d58ccc1565237da7
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 aff5a3ba390a8da122f1c4c8cea263d6a735bfa282a7be81885d9cfac057049d
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 cde23ea4b330574e841b7f658f15c47d60d71f54fef775c8b53d5ba0f469a6e9
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 60bd40ace8764d62347187aaf1abe3651134402d47cf26387a328b2da9f8bf04
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 950b48d67dcb35bfdd403b582b948bf2d79ee2b8bf05a6bb85e3620643b50da1
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 6e0f16c19fd279297d3e19724ce313af3a64f023063d0dfb6260466f2ab56060
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 124b78c8de84bdcaffebd6109d82a0e223e595bb67e03a7d7a8ca3dbec05532b
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 a96e097d10766d995743f18aa0c8f3567ddf647c740084d1de3386cfed54c9d4
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 4ae02a47e7522ac94e1b67d8e9899ef2a7ec30f645de7ef2e02bed4a44681e7b
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 c30713371a2a206320c7c17d68157135ad228e639232a1e3bad35df796926a2f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 261f9f65c664052c4c5be5447562359488993b7f6b06931a8fdbd6f305799b96
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 bc44c9128f3935977bab3f5a97ac9918b590d657f7e52f65fdb1968a791e7c7a
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 3762911fee3256b665c6dc0036cc23aba6fc7fff0bfe0df51251b5c3167c9ae4
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 066b94c942036ccc6876b3395991780a15842bf76d80d4746d70c99f74ce9509
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 5816e3476929b6f67e632451bd927df0003375952e033d450fa069e7687d9010
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 8458318fe5742745c4db660ab0658de6612254b4a6c7330f71ddd93a373a1917
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 3a599b10a298f8afd2b80794eb6fc0e2e062a3a0c90c6f74904a9f3690520758
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 5796b44d3d4b8534af4118b07b342c1c84a8fd44a6359a7bc35dffca670ff3f9
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 9dc16c5befcde0e7fc9b8e03bf1e0d27e0fd677ff37ecc4321972c8f8581c561
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 9af454ec985b8a3ebf53de9f55b0bd3009ca430a868ed7e2e93b81862039f3bc
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 d9840db512966d6a3722a7849b088692cb7647ce321778e6fba4afe945e85051
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 9a192cffc2cf808a583d568620803104ec07a0ae2c911769ceb34c2d03ee090f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 dd2030a4706b817028a0fd5c619c5f6ceaf11c1aa4dd7c66525dc40d64e94cf4
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 48a8afaf3bc210100092a10c21cfe2c545def16d66a6a67bece32d08076ba1bf
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 a24672f19c05b50d8a11cbe69adcc10d350b220f2b1539f6b73a3812187a2ea2
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 69a35f2caebaa9922f8995cdad5587d9230b11a09c9ce99aae2070275178fdfb
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 daa5afca63cf7333e496f73441445d32e75d4cbc0b1f5beca8ec9f933b94d31d
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 b6f6bcb133d6d71ab86671fac8798ede6688233ffd7c322d2679412b4dc5e953
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 3c828f1fab50b72b456f80ae7a210e549c477eee21e510e06f9f2dba170e4c69
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 eb8da0faeab2edbc057c0f24874622b2ec48fd808fbd15696c61b9948de01b1c
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 41c82d2350456f0ec05c064d324a3da0f5255db39b717b1b32d0a2ed4f3ec7a7
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 2b4853d3f881182256a385d94a0259f726b87949ba7e971f9be15f9d23271bf8
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 5dc8b7ac3e2ba193d073156626556210da0b83b0de35f486ed90d3b02499c28e
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 34877e089f0c36e5b0b2b80f2f40345a2c6b9a9ce5a3ff40e1c621b28e0c36db
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 53e5819413ecb3a359fd3d505fd9a7454441242d4ea2ff8d28dd25da07377786
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 38becdfda1fa89e4bf3b65265325811fd16bdfb8d69296dec1d3ace98b9656e3
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 ce3851cfaec44b9e7fd610efd3db7e50c0a6c94f74c928a642674d732b3dbdb9
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 656849b37f39f0a341e77a3c9937a011ecb0ded58b7f28dabc1bcdfcfa7b7bae
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 7ebcf06ea114ffb76d03f24eec5ad5e54189ebc09729aaf0f2f1ae3ee000762f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 d2e750713baa97ecb313986858d54f0b6df8b27ac86606c4f406faa185b731d0
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 8c5d5257d69435d2c9612a16643b4d947117025bf78fadbd24efe221af046177
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 18fe46c3b85265b0f56b8dab736f49cd48060ddc0f24d8ef92f20609df289b5f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 5a1137d9dac027af2c0e3c4d31e1a72bca57fafcee5947bba29043ea41f8ab09
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 595f34be08dc9efe6f29f81d3d9f9488b624b38b68deaa051e0750e2e015d391
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 0648fb89e86967855218bf2e8b34d00116b431148894149ad1f9125da53aed95
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 e0d0b7eb94038b6de361730b4de00dc7cde044b5f987b20ed340d2c63dae3579
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 4a5c1eaccf7070bc3d3dbcb21df95d1b5471c92f11cde471897c79ddcc1499ba
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 528a300a7e533fbe2b72a7db0fe13e6c51d6e1054d7e294d2c710088b1f17067
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 f41fcb30e128f5269fd51775ffa1d456384c69aa3acc606a6d55840b10ac41a6
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 e13f4ce8ea2a6d2c88405ba732abe4c7e60a4678a341bd601798ce3294e0d242
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 066717f59fa4a8cc4db6ca09c440af86da206014c78a8d57a0f740c6e6f4947b
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 180c1a55db819ffd85f1f1d2964a8bffde32baad70c546120e46e2142d01d0f5
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 ac13ba020d239ec6549ad854bd458dba26d805737cce4890ae8878ff0e601d3b
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 c4e09118b8a62432fd3e6bce373a4f27e89288db6c751e61adabfd6c9a342610
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 d06687b0624e2d6a7dac3bb99180153bbdbeeb756cb869c3408a3012791a93e0
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 809172d620b46aecbf9831821d991be9792d0e25050dd8a04f4ee6f7b740e562
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 1c5017dcd55eb1c2a037a69cf6c4b56ae244dcd77764519396639301f86ac586
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 09ecf66e29157e2370162364eab526d9a4c000f556411da2c157042603f5ae05
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 f3718dad1d4abb93bcd37fb2da930ed0c1905bd53d446263fa0b9dad3fd29916
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 010b1f47e5e1849b05b8b58af5390af43b8230b05e44082a352cd54cad7005c3
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 aac4e66663f4ab0dcd4383320c5991978bf628d7a3c04115f9aaa87c9faa7985
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 4950b37b69f36e9bc2dcb64fee215381a1d9a84225a3e8537d91612d81f00098
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 9f6778f68204505bd1b58ab89c8c586c11eba407d8357d36bbbedcb80e242fbb
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 d49fe4210081fb9bfa9a2494f679e729995a686d3050f721e83e3419d809a988
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 00cf63be402715241608c9d91294a0f3f1c235bc3fb530d0a77ebd4413d5231f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 12541da723e157220aec3f8ce5c2cd86981f6684de4403432819b86570fbba79
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 ae8ac169d84a7bdb846e0cae4307f498ff9291af27c8fd00583e896879f124d9
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 261b156e2da8410b2f7ca25fa981626e7f6cf2f2c6679b4f002865c9cae36e52
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 a59325312da1bee862ec355084646c3f0352b1e1de137b6f16e5e6470e9c72f5
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 6b8be774648a09dc8794e66b00235c9a5660493fdda936925ea2831e0c5673e6
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            pEMMAIAo.inf
                                                                                            • Path C:\ProgramData\fWAsQcIc\pEMMAIAo.inf
                                                                                            • Size 4B
                                                                                            • SHA256 7f448e94f095b75e9e32ab7b5b3050ccdef4cfbc97127eafd7f707140f1467eb
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            paos.txt
                                                                                            • Path C:\ProgramData\paos.txt
                                                                                            • Size 8KB
                                                                                            • SHA256 c56d839221d79822462865490e9d186577c218389049400db8fee8de12256848
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_c3841e2b6038e9f64e4666eef7c1011e_elex_virlock
                                                                                            • Size 43KB
                                                                                            • SHA256 609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            AIsU.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AIsU.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 62eead7a141a3f4824b8e9da4c0a755d08fb5ce8d5acb21b4392219650a6c74b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            AMIO.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AMIO.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 dfdd6e5701460e9852a362f707f3acf3006e24da5e60f0365e46a8b834b0e45b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            AQki.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AQki.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 7b31b78e453cdef5447ccce2d606c05342d911bc437defcc7a9b114c557b70d2
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            AUgU.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AUgU.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 b5634c24b2f05fe71deab7b3f2833e8f2c6ee8cf3efe13700b31b94c53edf418
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            AcYG.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AcYG.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 aa66fbb98a102371142502c1aa1e23d0b1bb6665b050f0ee076b4b94d19ac130
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            AsAU.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\AsAU.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 d8b8629668e4ab3151aedb48faa3d6a673eaa87f6d6c12ced52213d45ad9a32f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            CIUA.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\CIUA.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 dadc4e1ba40278ebd7c059ea218531d66de4bf56d80d6a89a1761634e5f060f7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            CIwW.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\CIwW.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 bfd97229c14ee9239f7ce48a7e0e314d6ff7b36272fdd0a5474021a8d537db9c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            CQUw.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\CQUw.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 13a949ed3f2b2aff0b9d84702c4ac2080288c94533a70d5ec2688cc0c21f3601
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            CUcY.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\CUcY.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 15518de42d6db3929e459d4a13b18923961c052e8209b44d68272521ec5263b1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            CYIm.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\CYIm.exe
                                                                                            • Size 2.7MB
                                                                                            • SHA256 0a5611826ed9bd4a8e088c722bb5d791ccc6b677059957efb716265cb6feb3ce
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            CgEq.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\CgEq.exe
                                                                                            • Size 2.3MB
                                                                                            • SHA256 a476fa516e0d337c2e1437a836ee74cc753c26c2059283a6dbea5e5ff5e9e6e0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Cocs.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Cocs.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 1850d3bfa588b58270da4f30228cfa8af8449ee5fd3a3c6b2605f225d7d0ca4a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Cscm.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Cscm.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 5c412464277f5af5a13baa917a3ab197374aa18e1ca2fa9b16dfc59744162d39
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            EAIa.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\EAIa.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 53b63598f227d45ed79c93e751868a87dfd5fb247866c067550b562e1845965c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            EMEa.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\EMEa.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 85a2a27b7e8608d97a93c6b0792945a06aa3bb0cf05f732cac383c42cccc2697
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            EQQu.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\EQQu.exe
                                                                                            • Size 2.1MB
                                                                                            • SHA256 74cb3de9033aed59ce78464e4b23abb87b57cda549223a24950657a65c5dd070
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ESEI.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ESEI.ico
                                                                                            • Size 4KB
                                                                                            • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            EkEE.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\EkEE.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 74ca3a7b86739f3c3efd15025579981448725c673e4d702cda2b2c546cd195e5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            EoMk.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\EoMk.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 95c11986c548480184244f243f11e7923dbc5f00141db3e54bdf9f6dfa54955d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Escs.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Escs.exe
                                                                                            • Size 2.3MB
                                                                                            • SHA256 783339d87b8b5866571524447a0897139f7b86ea4b7835e1093fa04b58c9503a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            EskC.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\EskC.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 1967fdb23217c47d77bf4b596f288fd952139e6f223c02b5ab6935173ba374f6
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            GEQM.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\GEQM.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 6a0ee5e38ca2f3c3f540a178a10316ddc003b2f17a145aa6ca8a17fba8641663
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            GgMy.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\GgMy.exe
                                                                                            • Size 1.8MB
                                                                                            • SHA256 37f85e9cd4d66987fa1ac1154e24bcded410970ec03f37cd89330850011a48f8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Gscs.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Gscs.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 5c59d85d0b31395ea47b847998a415e60c717a7522c89a8fae93fac195e189d3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IAkW.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IAkW.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 0995b54938f3076aba791c22d21852eae10a0062831bae26e0b9e7f8ad5f063f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IEMm.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IEMm.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 b10e5669483566a1fe9cfc175cc6021fc4811422bace3305023128aebe38d7ff
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IMEE.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IMEE.exe
                                                                                            • Size 2.4MB
                                                                                            • SHA256 2a57f014da8cde7241c4422935dd5385c60a5228bdc0b142288de8105ac487b0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Igkk.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Igkk.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 800eca22994bb2f564c155a6ad7cbb9f5ee6f8a872973adac54d29544339d0cd
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IkAQ.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IkAQ.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 617a208be01c7a28e62e6050ba9f81b6364fea7ab148d9b58f89898566490ad7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IskI.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IskI.ico
                                                                                            • Size 4KB
                                                                                            • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IwgI.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IwgI.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 a04fff41cb6f8b0b40d2b6caae2dc0ddd898b6885462b02700e390a8388ee637
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            IwsC.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IwsC.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 ed68a6206e91b3bb98641d1343486f97fa2b09e7f7a21e261f28d8768a0cbc01
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            KAwQ.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\KAwQ.exe
                                                                                            • Size 2.8MB
                                                                                            • SHA256 5b3e9be380fc7438cddafbbe98b4485bf23b66b0e29e516142425ce830548af7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            KcMA.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\KcMA.ico
                                                                                            • Size 4KB
                                                                                            • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            MIAe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\MIAe.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 dfdc700a3c08ae5a10b6bc754a74fdad4c4a67db3fa64e670363bc28e45e9d15
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            MoUo.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\MoUo.exe
                                                                                            • Size 2.3MB
                                                                                            • SHA256 af686aa8d07c749f732646eeebd47b80ba18282e34be87402dc74a3f04c5bf05
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            MsgA.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\MsgA.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 6f665ca26ba9d5803881b886ca70f3d04ff8be090202e13b154f534858ac14bf
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            MwcG.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\MwcG.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 bf2dcaeebce05974e89b6500448a7240e642899066fee3b8fad4021c55141bf1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            NIUMsEkU.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\NIUMsEkU.bat
                                                                                            • Size 112B
                                                                                            • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            OQQy.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\OQQy.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 3570e684d0bce290168b756ece1f6990c003d63d1d4a8a523a1c4d855d5685bc
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            OUIu.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\OUIu.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 5a049a6b264d90f20552606fb9d083965020a3e416b978b2d8ed5e791400fbd5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            OUsm.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\OUsm.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 47ff315845c47aa39921d505b50f343f39e1056df78abf16a6e72da680009855
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            OsMA.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\OsMA.exe
                                                                                            • Size 1.8MB
                                                                                            • SHA256 3f425a513cff2a913ec093c1434522867995321ff61358adba1fb31353e8513d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Oswk.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Oswk.exe
                                                                                            • Size 1.8MB
                                                                                            • SHA256 e66a67bb578a65b0705c2bf43d401284c8c1c9304b877de51fc7331755231b58
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            QAIe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\QAIe.exe
                                                                                            • Size 2.1MB
                                                                                            • SHA256 46ce7e8d576bfad658f777a8a3eb381c4aacaa4f3800781eed0cd9961c007dae
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            QIcw.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\QIcw.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 3f750bbf931f1c5f6016801297457afb256f2c3e0aaaca00e184099acaa7e672
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            QQEm.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\QQEm.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 6f68b454b403660883b8056a5c2d3a56e00e841f0bbdc7d0350e79cc76143b93
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            SEcM.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\SEcM.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 035a9f20dbdd45ce7e0d86aba58e00faa7a03983601154238a7743f750e353d6
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            SMoE.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\SMoE.exe
                                                                                            • Size 2.3MB
                                                                                            • SHA256 8efc107eacb852a2bdb667779245d880c272ea26c014f309df70c1ecbed4f67f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            SUMo.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\SUMo.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 2c98c38dc1d0d252685f66ce94b22869eac17e724dcbe649747375c5345cdfb2
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            UAAy.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\UAAy.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 9a1707896f307f7fb3364ac9c53269951a0cea9a086a20e561ca182450551fc7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            UEIA.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\UEIA.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 69958aa413603efb03fd5c808b749558d95089fa2868bdbd12a5621cb34cd751
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            UkoA.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\UkoA.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 ffe722a6bbf05fd40132304462a45205bdb68afcaf5bf7383cd7bbdeee40207f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            UwcA.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\UwcA.exe
                                                                                            • Size 1.7MB
                                                                                            • SHA256 47a2b34ad72b7448f5d9105d51e4daf618f466c76e37a3f346ba579ae58930e7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            WYgU.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\WYgU.exe
                                                                                            • Size 2.1MB
                                                                                            • SHA256 621dca0cac52ef7fa6cb1df604e2ca6747aaf7663c33426930f3981385749a76
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            WggE.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\WggE.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 88320cf5416009b99d070969a4a0e15dc216d7fb09e1701f94a9e86e5f84ea72
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Wgsq.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Wgsq.exe
                                                                                            • Size 2.3MB
                                                                                            • SHA256 6072798c744c499bed7e376230ce4302f8277c9b9769bd3355c6403e166c4428
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Wwco.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Wwco.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 2a8d2b528d67e0dfcf75c6705a81ff6e30a032f7b73019ddee6ca4bc8656450c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            YQAA.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\YQAA.exe
                                                                                            • Size 2.1MB
                                                                                            • SHA256 22814826e8389035867ba01b9ddaf95dc767eca281201640380f43f92f89fa08
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            YYIW.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\YYIW.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 07ce6b8ee8d5c0073b3c1f3a4f78e20f770757f5ef6cc0576ae4f6465ddaa964
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Ygca.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Ygca.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 93ae10b42023b6d3501dd16db9827697fcb8099dc0d75693477619180e50b96e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            aEwA.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aEwA.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 44d7c647b8747b84445577e11104fbfe10fd83ac18e0c1e0e9955e9d5e354e34
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            aMUA.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aMUA.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 4a1a695b84e72bd775e5a9b3c57851996556428ba9573dbdb4750f8503bc5466
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            aUIG.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aUIG.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 93dd5772091261a77b7122d913806519fdc80178a811a1a9b67d94ec474b3c35
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            awcA.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\awcA.ico
                                                                                            • Size 4KB
                                                                                            • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            awoK.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\awoK.exe
                                                                                            • Size 2.6MB
                                                                                            • SHA256 0f6677afee0037f0de8aa3e9f831070a3b9ecf312646175f6951c9abe246de4d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            cIYo.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\cIYo.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 c53acd8099e401ffc74c61bdb42cfe26a6f103d63a37fb1addd2ef7deb1d6177
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            cwwW.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\cwwW.exe
                                                                                            • Size 2.1MB
                                                                                            • SHA256 b23ff9965a7a15405ef34c36587653246344639492780ce3617cf1bd1b76263b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            eIkc.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\eIkc.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 f927c309102a4bfb9a23eb4c7092fc38a3621eb58ec8647318ab3894c88b5180
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            eQkU.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\eQkU.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 7e01ae670c66fc7813b598377a00c487f3621155c6b51cda6ef648ced68769ca
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            eUQu.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\eUQu.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 72ff6956e5ed1a555b8b054f9e87df8823838eb72cd24f1d27bc0bac9c1c69d4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            egMS.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\egMS.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 1909cfd602a509a998107cabc1f161f6890ae1c593239f43be532e3493c4f5db
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ekca.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ekca.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 5c20478b659f52f64c0a647439fe6b0f0b074bca8065aa9b59e38a514b805c91
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            file.vbs
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                                                                                            • Size 19B
                                                                                            • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            gYos.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\gYos.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 50472da8a83f2a9c9f4519e3884313ccbe7e55f41c1a8fc72e5076f0adf08232
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            gkMq.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\gkMq.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 9edf96ec65f3a937a82325db7caccccefcffb4d605ab25fadee08bb203314a99
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            gygs.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\gygs.ico
                                                                                            • Size 4KB
                                                                                            • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            iEsc.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\iEsc.exe
                                                                                            • Size 2.1MB
                                                                                            • SHA256 5aeb25b92886986a6c66958d0aad6a7ff0c81067cde177e60431d60fa46329f1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            iMkc.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\iMkc.exe
                                                                                            • Size 1.8MB
                                                                                            • SHA256 b96de5112476eeb10413e4f95b22a89262dd1c4e665fd85de74b47a48f12d445
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            iQcm.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\iQcm.exe
                                                                                            • Size 1.8MB
                                                                                            • SHA256 c17c0c91af8a986fab6f64a72bf05645833f3114095f1eff6571f17c82e83e74
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            icYc.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\icYc.ico
                                                                                            • Size 4KB
                                                                                            • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            igky.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\igky.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 a85d18d145ecbf2c36ad80a0eb12a1ff7209f992d0ae12f887f7cbd914a0d270
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            isAQ.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\isAQ.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 46a8598371cf84681080c01ae1ee9f9206ae4a5d724816b57c655b4e7ac8e524
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            kEIw.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\kEIw.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 6197da09a5366b59c2fb977f2fe6e9585ae7c1d50ea9174ed217355f6b049fe7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            kMUC.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\kMUC.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 ea51b9ad635c49f186897d4f105de5512a6a6724c954ec7984a0e9aaa8f314cb
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            kgok.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\kgok.exe
                                                                                            • Size 2.9MB
                                                                                            • SHA256 3df618710b0b2b136a3cd2638ee419199ef1550e0284a4ff1615364997737b77
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            mUcs.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\mUcs.exe
                                                                                            • Size 1.7MB
                                                                                            • SHA256 40c2ce94565f8e4d5fee6a1c259f7a392be4ac5cf3c1414679c847817661d618
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            mYAw.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\mYAw.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 7ecc21ca126122c2a96ebb3a35c4c35fbcb1ffbc51bec394bb5a501e198a5031
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            mYYC.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\mYYC.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 5a09cee826beaebe87d201bc0ca3d0bf8fbb3dc0bc938bc40a14cbf68f427f9b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            oIcC.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\oIcC.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 43c65d513048594e0a385194da641b68cb0d9292ff5666341b2d5096ca606e55
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            oMsM.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\oMsM.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 2e0b7be2c740c2e4f912c8abe0808402274f18c580b706be57190f2db5151b88
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            oUsa.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\oUsa.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 49c7ac9da258d02658de5c74afa379d33720e788eaf8d5231251872a72bc20cf
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            okUC.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\okUC.exe
                                                                                            • Size 2.1MB
                                                                                            • SHA256 8bad1ae5063e644853d4a92530da1c9a4b0202b5d5f3b0d64e3a30efa79cfc9b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            qEkE.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\qEkE.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 e435bd94e9f331027e1974fc479b9059f961e31751dd5384a3963f494e2c9af3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            qcoE.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\qcoE.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 ed6d369f9d7c2fd77cdcd2bd5ad12be8cf8e1fd323b36a6bb4d96f34c8d3bff3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            quIo.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\quIo.ico
                                                                                            • Size 4KB
                                                                                            • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            qwwK.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\qwwK.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 cb87a765025a1f145db0cc8c207045c1c126c2de341b85ce97c43e1e7f3f3813
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            sEAa.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sEAa.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 4869aaff32276ac0e8ab3309c8f6a6ce6e5f092ca83488456b8b473395007c0a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            sEcQ.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sEcQ.exe
                                                                                            • Size 3.1MB
                                                                                            • SHA256 b848a356d9426801ddf7fccd58997d44946fb80c0e4c96a6d3fa4c866a6ce746
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            sQYo.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sQYo.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 759e88585e90bbe61b15cb1b012e420da456314a2e1f343ef5f8fe6a06e0b420
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            sgYO.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\sgYO.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 3aeb86feb9ce0533427d5cbad062ee82cb13a7440a9d875056630b061632b665
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uAUo.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uAUo.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 b6e22ad57c58a8aa06ca3093404b3b4a02a93544fdc2a5cf942ee90772a862ca
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uEcM.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uEcM.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 4571aab99e04ffbff72de9ec64084a8893caef7224609cc18c0be84fefcc5f1d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uEcy.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uEcy.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 f59e5052be0085c367a0a4974e6e68c3c810ee68034de0fadf2bb7a622220c59
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uEow.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uEow.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 489b688c39b78f5b08a46914523366d9ffbbae2c56dfbe83dd2aa2d49a48a59f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uIgU.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uIgU.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 5bbbab1f1d98aef9dc730fbd0d7d97774599a113e06d58d1a18fff75bca821f8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uYcW.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uYcW.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 9cd722d4a5b07d185653a818cdd85e98e109ebf573f22feaa856fd763fd2dc13
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uYgo.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uYgo.exe
                                                                                            • Size 4.0MB
                                                                                            • SHA256 67ec2f493c406a02cf3f7f5f470d6a25c24ca6ea48662aad355525a782b26aa8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uYkE.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uYkE.exe
                                                                                            • Size 1.7MB
                                                                                            • SHA256 0adc056f144afd6ea39a63bbb996453e50a09a33770f785a74728555afb0a629
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ucMk.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ucMk.exe
                                                                                            • Size 2.4MB
                                                                                            • SHA256 0a545e8568ea5ddd1449f2bf42c1e62972b57737c705592aa60af15731556138
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ugMA.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ugMA.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 8135c71d585925d830ac3001983096a81bfc2f1c3a41c5533a5fa647c660999b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ugwI.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ugwI.ico
                                                                                            • Size 4KB
                                                                                            • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uoYC.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uoYC.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 e2b79c93979179fd59db0c34f9b66e81a6ce704ad3f3f8bf8f4e12b9781e9772
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uwQM.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uwQM.exe
                                                                                            • Size 2.6MB
                                                                                            • SHA256 166ef491b6882137454521a4b40ae4d4836423a55a32fac40d973a56695aca33
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            uwgC.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uwgC.exe
                                                                                            • Size 1.7MB
                                                                                            • SHA256 b9ed7a3f7e213f4f8a5799b2145113d98967c4eeaeb8e07b2fe3c262fcb98ca3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            wQwq.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wQwq.exe
                                                                                            • Size 2.6MB
                                                                                            • SHA256 64dbcd68b37e0ce0160236cedb7351a7fe46eb1bf56c2f2731131e6285210cde
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            wUkw.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wUkw.exe
                                                                                            • Size 1.8MB
                                                                                            • SHA256 25b0efee024b3d039f6bc3b5d8e8263cd10da0afba974e12be89ebe899108488
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            wYwc.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wYwc.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 1e62ebb9ac61f1b43343d555594d0dad3c68a30af98bb0461c197c7a0202ba45
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            wcgq.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wcgq.exe
                                                                                            • Size 2.0MB
                                                                                            • SHA256 7160264b7ffc271c076bb3da6f660d41374075de47efc4f45d2c1e71bad9196d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            wiYY.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wiYY.ico
                                                                                            • Size 4KB
                                                                                            • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            woMW.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\woMW.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 3c759d1c443f3e6eeb01d9efeb8cc836581296ddd4423e812671193d196c473a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            wwwQ.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\wwwQ.exe
                                                                                            • Size 1.9MB
                                                                                            • SHA256 cb6983f573c5ded9855c3a912d4b194f06a0b9af4f07ee1483236f68af25a4b8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            yAQU.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\yAQU.exe
                                                                                            • Size 2.2MB
                                                                                            • SHA256 0e606abe7ff0b8f1d8a096be24b044420aa688141e779ffc816abc743f0f7203
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            yEsU.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\yEsU.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 8f48934df29cf9441726c7f350043d585548b53a7a22a883b7d7358329ac52f7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            yIYm.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\yIYm.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 b73e61a22f060198344a934158896573970ae65db4c48916e7587cc72db1d0b8
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            yMUq.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\yMUq.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 aeab8b3a68ec393f2de7c4f5aaa484fb6085187f0b787f5b34000916b562b065
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ykIU.ico
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ykIU.ico
                                                                                            • Size 4KB
                                                                                            • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            ysEs.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ysEs.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 35908c4982fbb78c1658e5e1c55422a2fae4cb57eeaeea1d0f3c85072ec696b3
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            eWYoggwc.exe
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.exe
                                                                                            • Size 1.6MB
                                                                                            • SHA256 3e8aa9fc68bbec614eb2fb7835060846e9e9d5f6b9f189c68c0650a986334b3e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 05d878cbae0922dd0acb93457211b790c10310470befeb5842fa8bf20de500f9
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 8b7d4463a9f731f5b17c3232011960d029d490736d4c0ae3dd02dfbdf90f17e8
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 c809ace69d31cbcbe2a91a0ff9e23c04feba3b503ac509e88990ec9c23aad2ef
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 545293c5a77e17b40ada01fb8b1ab048ab8d26acec0a36228e31a80b2f0ce10d
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 52d0209d972fb695babf16a4439bfd3a68b4ea8b7176b87803a57be5df2ed095
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 f69c1da979bace566b5b3540915fbfb906132eef77577ff1f812e2d315b743ab
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 70620e5ef9780038b549d913b7dbbec4689ac6e4233c50396ec9330baf38c322
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 f62a15ad3d0ad912816abd66cf945d2849e61cd842d9be36b87e20e8d2e4dfb7
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 bd93a76ba9e4efbdbc25da20dac7a38b3a866946f032a1b28fe00908c675d1ea
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 27ff9120cb8663a5f22dcb50b318e2cfb16b8fecb9f32dbaba4e047fbf0bcf1b
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 32f60930cec6a0f7c8383b4592437154bffb2e07e0f72950c4bb7e3040fc2779
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 d368ad3398f36b4bec2b3c64dddfe4b8fd36b89f44bd594e296bfba5da258b32
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 98649632c45590a94c8b491849ab698b49817587e13117b398a74622e784885b
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 b10413cf241d4ee69f7620eeee2d51d9defbfa12c61f70547d818089e5c28dc7
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 446e9af06026adbd02d33125efaa8a12cd8659ebaa254b4e3eb0be7a00d599b8
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 28488db18c3e9ff5ac836d3d1dd35716e43c0a572fe0ee638545e2f4cd2c9e7a
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 278f5bfd557785e91e24b9f98b36bb416bf2a8970c3cbe43662cf5d7dffaa8c1
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 9c7464eaf5337ce303b5d528e52aa58916d9b590cfca615a7a644c726086b3e7
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 05a7b462223ac05ca41910d8f8baa5949bc29ae0267f7cf442bf34b89614d774
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 e9bc4d4046b3c7bd3a55248f7c0b73e877f1abeb09c6e71b4cabc18d3e10df0a
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 f08d5c10431ea870bbd6b31bab1031132191dd373c015793e8fa2e5ea1ee035a
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 3cf7567a1d06d7ca68b3d31bb3a2343e84f8d08d412d700742a532ffd87b39eb
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 4692ad2ec76fa6d65f7df1eb736caf071402dade9e0d25d4a400dc19466e1dfa
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 db56ad7926c3f5572105635b987048370beeea4892930acfaa7cbba193726df1
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 da095501db64808a0b93757e86304a93ce4f0fa113ac1ff6b099bc188f3bba6e
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 1e63dc0eecc9e19d1bc5e5ac1ed37eeb53edd30211e3b31506a830a8a5148c03
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 f6ff7b3cc5512d633152e8231bc83e222883ded61f171a7c2118fb6fa30dbdb7
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 7efd88d54a0c860c8e91777bd13e14b99927e5d8ff3cda5fefa1ed1ddea87d1e
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 8c12bd403ffc5afde2ee1c80985f6c0162336614e73f7d8895e4d47101c824c4
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 d3409e128df04f34e24d83e10aca125052d9c19d1df84df5d11582d11a69e406
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 5aa9132993393cc819e0cfad26d9a582d5c670de51d94847dc23f6bd30c041b9
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 92b5a88f1a70d49f6e951fdd0edcac665f4d1fa9471414c588e972da8bbe9f4a
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 223b29973b6d38b167358824fa0a6d52358be5239c812822db9de081c8e5ec23
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 1098ba32a469f5b7e206283437aaa83780564a93fdd832179d4cca0282ffe965
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 dc4076aabf11079af7e335db35e006974a1184a8372083236fe10785a3628be5
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 74318d084aaa1b68b1bce43c04c4f84834a0aff6b35029d39467c8b73bf7bbd3
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 3ba598e107498a72b382ca5fa873e4b649429f5e79d925398fbede66f2fe9069
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 e10ee5a1aad56403225e0818309699b0cdd1771823f38f001853338c211c9ef1
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 008dee2c3985e407e59bcc122592da58c87f8ff1176103baebffbf4015ad5c56
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 824038f4c785f42abeb4da4ed8af0457fa81ed74c402a1a9b80864458c2de66d
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 dddb7154db84c992b864c8acc34e4a250cf4d27ea5d5068dbe86649479feef30
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 90d04364ac0109efa77efe07ff04e1040bd9d90246803faeaf3fa945c3686dc7
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 6d68458292c413b334cba63567a7b4e686e975964be0289e9c46295fc12fa384
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 1d68ff26d7aca803b33705c3ebdbfb025e01674b520dd3585f705be7fd334b10
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 d534d48d574ce01dc634c7caf77a6b810ea91938d23bfdfad2713e6c7fbf8a39
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 3c14009e183082106b4d394c51314337d7a1a21cac545075ef7afa1e4b32d174
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 194e43dd852201ddcfc6f92314a3d72369ea51dc12b7a8b48cdd0ca6f65e48e9
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 7a1f213ccf084560bff530511a32e1155eb2a9bb6e8a051490c94bb0c6d9d109
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 2059910175c5897ef37baa3ae73980eb387b7dc6e3683369af3b3dc84fa2b794
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 6d4273729eee9be8c10a7941836f6d027a441dc4d43978d612543d3a407962ca
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 c59f126283981b88bbe45cc9a5bf85361ec2c1ddad96884a7bd1658112b34c7c
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 8cf2e74c5928a38c95bd0737b4f4e661adeb784f7b72213a533044777e152b89
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            eWYoggwc.inf
                                                                                            • Path C:\Users\Admin\IuwccsEY\eWYoggwc.inf
                                                                                            • Size 4B
                                                                                            • SHA256 d0041f15033bf6b558cbc89f59a01c4dd328cf04ad2cfa413a9fd1690db90196
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            memory/908-194-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/944-2350-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/1124-347-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/1336-108-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/1372-208-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/1412-237-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/1476-317-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/1564-76-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/2012-8-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/2012-2036-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/2012-1794-0x00000000041A0000-0x00000000041C0000-memory.dmp
                                                                                            Download

                                                                                            memory/2012-428-0x00000000041A0000-0x00000000041C0000-memory.dmp
                                                                                            Download

                                                                                            memory/2148-380-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/2424-388-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/2424-393-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/2548-360-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/2624-153-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/2624-133-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/2996-2067-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/3036-2342-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/3248-339-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/3520-424-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/3572-120-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/3620-369-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/3756-64-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/3864-329-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4136-165-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4172-298-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4240-137-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4284-93-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4308-449-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4332-308-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4380-2051-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/4380-19-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/4496-2358-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/4596-508-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4848-2043-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/4848-16-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/4912-2075-0x0000000000400000-0x0000000000590000-memory.dmp
                                                                                            Download

                                                                                            memory/4952-225-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4956-0-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4956-32-0x0000000000B90000-0x0000000000BB0000-memory.dmp
                                                                                            Download

                                                                                            memory/4956-3-0x0000000000B90000-0x0000000000BB0000-memory.dmp
                                                                                            Download

                                                                                            memory/4956-31-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/4968-268-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/5012-256-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/5428-27-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/5428-42-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/5740-403-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/5740-394-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/5888-414-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/6044-246-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/6080-277-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/6088-181-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download

                                                                                            memory/6100-286-0x0000000000400000-0x000000000059C000-memory.dmp
                                                                                            Download