Overview

overview

10

Static

static

3

2026-07-30...ck.exe

windows10-2004-x64

10

2026-07-30...ck.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 01:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
  • Size 1.6MB
  • Sample260730-bn3dnaaa27
  • SHA256 648ffdaa8521088786676fade923a159755f18dd05257fba3a0660b35efb5c3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionnabucurpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

    ransomwarenabucur
  • Modifies visibility of file extensions in Explorer 2 TTPs 22 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 22 IoCs
    defense_evasiontrojan
  • Renames multiple (115) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 22 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 44 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:7040
    • C:\Users\Admin\qwgcwsgs\NMYYQwkY.exe
      "C:\Users\Admin\qwgcwsgs\NMYYQwkY.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:1784
      • C:\ProgramData\XucsMIcY\ZOIAYIEA.exe
        "C:\ProgramData\XucsMIcY\ZOIAYIEA.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:3348
    • C:\ProgramData\XucsMIcY\ZOIAYIEA.exe
      "C:\ProgramData\XucsMIcY\ZOIAYIEA.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2488
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4304
      • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:7120
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1460
          • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
            C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5676
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2896
              • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2064
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:248
                  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:3708
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4752
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                        C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                        11⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1136
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1988
                          • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                            C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                            13⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:5672
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1156
                              • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:6172
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5448
                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                    17⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:6500
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:6588
                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                        C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5976
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                          20⤵
                                          • Executes a command shell one-liner
                                          PID:3052
                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                            C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                            21⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:6844
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              PID:4256
                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                23⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5376
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  PID:964
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                    25⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3532
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      PID:4572
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                        27⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2952
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          PID:1180
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                            C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                            29⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4844
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              PID:1984
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                                31⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:5092
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:5732
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                                    33⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3732
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      PID:7016
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        35⤵
                                                                          PID:1308
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                                          35⤵
                                                                            PID:5392
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                                              36⤵
                                                                              • Executes a command shell one-liner
                                                                              PID:1964
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                                                37⤵
                                                                                  PID:6088
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                                                    38⤵
                                                                                    • Executes a command shell one-liner
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:5184
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                                                      39⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:6016
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                                                        40⤵
                                                                                        • Executes a command shell one-liner
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:5160
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                                                          41⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:6360
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                                                            42⤵
                                                                                            • Executes a command shell one-liner
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:7156
                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                                                                                              43⤵
                                                                                                PID:860
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock"
                                                                                                  44⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:360
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                                  44⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry key
                                                                                                  PID:6180
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                                  44⤵
                                                                                                  • Modifies registry key
                                                                                                  PID:292
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                                  44⤵
                                                                                                  • UAC bypass
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry key
                                                                                                  PID:260
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eKUsogMg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                                                                  44⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:1092
                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                    45⤵
                                                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                                                    PID:1468
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                              42⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Modifies registry key
                                                                                              PID:1480
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                              42⤵
                                                                                              • Modifies registry key
                                                                                              PID:1992
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                              42⤵
                                                                                              • UAC bypass
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry key
                                                                                              PID:900
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LiYAkIQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                                                              42⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:6832
                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                                43⤵
                                                                                                • Executes a VBScript file via the Windows Script Host.
                                                                                                PID:1148
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                          40⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry key
                                                                                          PID:3056
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                          40⤵
                                                                                          • Modifies registry key
                                                                                          PID:5320
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                          40⤵
                                                                                          • UAC bypass
                                                                                          • Modifies registry key
                                                                                          PID:5332
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RCsEUcAA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                                                          40⤵
                                                                                          • Executes a command shell one-liner
                                                                                          PID:5108
                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                            41⤵
                                                                                            • Executes a VBScript file via the Windows Script Host.
                                                                                            PID:5080
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                      38⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Modifies registry key
                                                                                      PID:6428
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                      38⤵
                                                                                      • Modifies registry key
                                                                                      PID:2176
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                      38⤵
                                                                                      • UAC bypass
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry key
                                                                                      PID:1600
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GYEwQgIQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                                                      38⤵
                                                                                      • Executes a command shell one-liner
                                                                                      PID:6324
                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                        39⤵
                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2112
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                  36⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry key
                                                                                  PID:6068
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    37⤵
                                                                                      PID:6980
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                    36⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry key
                                                                                    PID:2104
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                    36⤵
                                                                                    • UAC bypass
                                                                                    • Modifies registry key
                                                                                    PID:2516
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sOkYcMwI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                                                    36⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:6336
                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                      37⤵
                                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                                      PID:5836
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                                34⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:5124
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                                34⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:5888
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                                34⤵
                                                                                • UAC bypass
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry key
                                                                                PID:6604
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\biEkYMko.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                                                34⤵
                                                                                • Executes a command shell one-liner
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2020
                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                                  35⤵
                                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                                  PID:6080
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                            32⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry key
                                                                            PID:4128
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                            32⤵
                                                                            • Modifies registry key
                                                                            PID:1128
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                            32⤵
                                                                            • UAC bypass
                                                                            • Modifies registry key
                                                                            PID:5192
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RwMQMccI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                                            32⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:2468
                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                              33⤵
                                                                              • Executes a VBScript file via the Windows Script Host.
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1112
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                        30⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Modifies registry key
                                                                        PID:5164
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                        30⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:2028
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                        30⤵
                                                                        • UAC bypass
                                                                        • Modifies registry key
                                                                        PID:5500
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rmMMUMEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                                        30⤵
                                                                        • Executes a command shell one-liner
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1520
                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                          31⤵
                                                                          • Executes a VBScript file via the Windows Script Host.
                                                                          PID:2144
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                    28⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:3120
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                    28⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:2092
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                    28⤵
                                                                    • UAC bypass
                                                                    • Modifies registry key
                                                                    PID:2820
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QqMcMIYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                                    28⤵
                                                                    • Executes a command shell one-liner
                                                                    PID:5312
                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                      29⤵
                                                                      • Executes a VBScript file via the Windows Script Host.
                                                                      PID:2620
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                26⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry key
                                                                PID:1468
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                26⤵
                                                                • Modifies registry key
                                                                PID:5480
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                26⤵
                                                                • UAC bypass
                                                                • Modifies registry key
                                                                PID:992
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  27⤵
                                                                    PID:5476
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UygwEQcw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                                  26⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:6684
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    27⤵
                                                                    • Executes a VBScript file via the Windows Script Host.
                                                                    PID:2720
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                              24⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Modifies registry key
                                                              PID:3948
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                              24⤵
                                                              • Modifies registry key
                                                              PID:3504
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                              24⤵
                                                              • UAC bypass
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry key
                                                              PID:2484
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EkIcEIow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                              24⤵
                                                              • Executes a command shell one-liner
                                                              PID:3216
                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                25⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4716
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                          22⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          PID:5540
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                          22⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry key
                                                          PID:1960
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                          22⤵
                                                          • UAC bypass
                                                          • Modifies registry key
                                                          PID:1228
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BoIIcYEg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                          22⤵
                                                          • Executes a command shell one-liner
                                                          PID:3228
                                                          • C:\Windows\SysWOW64\cscript.exe
                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                            23⤵
                                                            • Executes a VBScript file via the Windows Script Host.
                                                            PID:260
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                      20⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:3704
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                      20⤵
                                                      • Modifies registry key
                                                      PID:4696
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                      20⤵
                                                      • UAC bypass
                                                      • Modifies registry key
                                                      PID:3152
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HKsEkQsc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                      20⤵
                                                      • Executes a command shell one-liner
                                                      PID:2832
                                                      • C:\Windows\SysWOW64\cscript.exe
                                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                        21⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        PID:3472
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                  18⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Modifies registry key
                                                  PID:4388
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                  18⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:4732
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                  18⤵
                                                  • UAC bypass
                                                  • Modifies registry key
                                                  PID:4792
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xUcEIQUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                                  18⤵
                                                  • Executes a command shell one-liner
                                                  PID:4112
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                    19⤵
                                                    • Executes a VBScript file via the Windows Script Host.
                                                    • System Location Discovery: System Language Discovery
                                                    PID:6636
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                              16⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Modifies registry key
                                              PID:6980
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                              16⤵
                                              • Modifies registry key
                                              PID:2104
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                              16⤵
                                              • UAC bypass
                                              • Modifies registry key
                                              PID:4504
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wIkkQogY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                              16⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:3672
                                              • C:\Windows\SysWOW64\cscript.exe
                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                17⤵
                                                • Executes a VBScript file via the Windows Script Host.
                                                • System Location Discovery: System Language Discovery
                                                PID:6348
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                          14⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Modifies registry key
                                          PID:1080
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                          14⤵
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:1308
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                          14⤵
                                          • UAC bypass
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry key
                                          PID:5128
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UeQwwkcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                          14⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:1264
                                          • C:\Windows\SysWOW64\cscript.exe
                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                            15⤵
                                            • Executes a VBScript file via the Windows Script Host.
                                            PID:5560
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                      12⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:7112
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                      12⤵
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:1484
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                      12⤵
                                      • UAC bypass
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:5092
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kyYUEAww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                      12⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2448
                                      • C:\Windows\SysWOW64\cscript.exe
                                        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                        13⤵
                                        • Executes a VBScript file via the Windows Script Host.
                                        PID:4548
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  10⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Modifies registry key
                                  PID:3004
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  10⤵
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:6744
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  10⤵
                                  • UAC bypass
                                  • Modifies registry key
                                  PID:4144
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VUMUMkcE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                  10⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:6484
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                    11⤵
                                    • Executes a VBScript file via the Windows Script Host.
                                    • System Location Discovery: System Language Discovery
                                    PID:1612
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:6212
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                              8⤵
                                PID:2772
                              • C:\Windows\SysWOW64\reg.exe
                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                8⤵
                                • UAC bypass
                                • Modifies registry key
                                PID:3412
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rQwswgII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                                8⤵
                                • Executes a command shell one-liner
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:6504
                                • C:\Windows\SysWOW64\cscript.exe
                                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                  9⤵
                                  • Executes a VBScript file via the Windows Script Host.
                                  • System Location Discovery: System Language Discovery
                                  PID:5312
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                            6⤵
                            • Modifies visibility of file extensions in Explorer
                            • System Location Discovery: System Language Discovery
                            • Modifies registry key
                            PID:5476
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                            6⤵
                            • System Location Discovery: System Language Discovery
                            • Modifies registry key
                            PID:5856
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                            6⤵
                            • UAC bypass
                            • System Location Discovery: System Language Discovery
                            • Modifies registry key
                            PID:4716
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jOgIQYQA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                            6⤵
                            • Executes a command shell one-liner
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2748
                            • C:\Windows\SysWOW64\cscript.exe
                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                              7⤵
                              • Executes a VBScript file via the Windows Script Host.
                              PID:5572
                      • C:\Windows\SysWOW64\reg.exe
                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                        4⤵
                        • Modifies visibility of file extensions in Explorer
                        • Modifies registry key
                        PID:3940
                      • C:\Windows\SysWOW64\reg.exe
                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                        4⤵
                        • Modifies registry key
                        PID:2676
                      • C:\Windows\SysWOW64\reg.exe
                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                        4⤵
                        • UAC bypass
                        • System Location Discovery: System Language Discovery
                        • Modifies registry key
                        PID:6872
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CWwEkUkU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                        4⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:4816
                        • C:\Windows\SysWOW64\cscript.exe
                          cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                          5⤵
                          • Executes a VBScript file via the Windows Script Host.
                          PID:6468
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                    2⤵
                    • Modifies visibility of file extensions in Explorer
                    • Modifies registry key
                    PID:6848
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies registry key
                    PID:5020
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                    2⤵
                    • UAC bypass
                    • System Location Discovery: System Language Discovery
                    • Modifies registry key
                    PID:1816
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GGsIoQAs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock.exe""
                    2⤵
                    • Executes a command shell one-liner
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3400
                    • C:\Windows\SysWOW64\cscript.exe
                      cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                      3⤵
                      • Executes a VBScript file via the Windows Script Host.
                      • System Location Discovery: System Language Discovery
                      PID:3136
                • C:\ProgramData\oUYgIsQo\caIgIsko.exe
                  C:\ProgramData\oUYgIsQo\caIgIsko.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  PID:6560
                • C:\ProgramData\XucsMIcY\ZOIAYIEA.exe
                  C:\ProgramData\XucsMIcY\ZOIAYIEA.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  PID:4900
                • C:\Users\Admin\qwgcwsgs\NMYYQwkY.exe
                  C:\Users\Admin\qwgcwsgs\NMYYQwkY.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:1260
                • C:\Windows\System32\sihclient.exe
                  C:\Windows\System32\sihclient.exe /cv eeuaEXPMN0OpOr48AvP8aQ.0.2
                  1⤵
                    PID:1600

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        2
                        T1059

                        Visual Basic

                        1
                        T1059.005

                        Windows Command Shell

                        1
                        T1059.003

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Privilege Escalation

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Defense Evasion

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Hide Artifacts

                        1
                        T1564

                        Hidden Files and Directories

                        1
                        T1564.001

                        Impair Defenses

                        1
                        T1562

                        Disable or Modify Tools

                        1
                        T1562.001

                        Modify Registry

                        4
                        T1112

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        System Information Discovery

                        1
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        ZOIAYIEA.exe
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.exe
                        • Size 1.6MB
                        • SHA256 ff01fe44e1902f46dce4b239e7772e1014ab54982b7fa68a3b7c89c10429ad78
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 becb4b7b87a76c2884466c4be56b7f746b7975b5a660fa7991ff1d0aa257760d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 ab1732eb022cc6a908b5323fca517136b945834d898f479e719ac312d908ce5e
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 41a629d4124af68a0b15cb03e6774ade2675d8b44edd0b4f71ba144b7bf4ad1a
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 f0237efd0ca25e61db6a7f62843c3dc9d445440091b82649311c9e31f7d0122f
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 ede373c0351a83fb9cab619054e433aeb7569d75e775714d05f3298bc440b0e6
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 8a525d6283d4839c45ab369276e5d5a1dbbad2a0378f294e8ee36c6d24edce09
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 8507c75a9e07e4842696a02b7abb5d5bdaeb8d89b652c15444ea3d40348f61a7
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 cf795398e13ad8707774205a97a0812c500190014747c3a2adc26f8439c8bb9a
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 e6667306ca9fce37298a97b00fc0769c695d986349bde33a9180452adb867697
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 9f9157e5470e2e53a7149f68b4b428ed19040b1a41848a3a1581ab8c88c14bb2
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 c1f40b62d409c6e2d916d14b691b0f30d4d68f933983b86739f9f4ec52507f40
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 2f6d95242ba81121d35fb9bf5f58fa16763ec1675751bc491fba068d9e28ea1f
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 cc86a0cab6dd91f66b5141d947cd46978288abb9f9244fa5e35d6cf3f270c0d2
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 ee8cacfb5698a95f26232a2d6dd66e83ea6779cc1d6b3bad6609f2a09788d08e
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 dd270f829e08b489d5011fdf5e8790114bd3c2839b5cabc5b77fe498544a6b01
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 1fc8bd102c950d50c1e5c793578c6eab35e36ddab5787a823e5cfb7e6609ad7d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 1cf0479e081d3647f9ca51b492cd469c8812b31fe18a0f5368e6208dc4afc8f5
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 21b38f8120a946b06b410ebb7826e69321bdef0b0eb235995a11b0703ebe56d6
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 16bc0a3810dc397f68bd2cd38c82d3e624c71c99c82d61e88fdd3ab678ad51b0
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 1c78b3adffb60236fc7a82dcb88798217b19899cbe66d8a6a69bbe26af9a6edb
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 39c74cc062466901192df80943c643b4530e90f6241bb960a49082ed04f7adbb
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 ef268f7014dd88cde8a34aab0ee8f1f9697655df66b7a619c7989d6e3846d924
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 55f23c0d31be623cff091a6dc922f9688c9f77d1795810b48c3b41f8865a4669
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 d14fff2569796d1011e29226d1d9b64bc83a58f5aa20ee3f71d9f5f9200958d1
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 1408b2209805ecd0e60e4e6f03e500db92a9e5c8aa032941e5585e8609d9ef57
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 3031fbbf33ea74c064199d10429692a4c59df2401cc8080a6a54eb6ff355a5ac
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 68681ea770990c8f96a4c43753fa3fba7f1902f4240183fa66837cb34b080044
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 23ab3d5848f7ac321e472f020901519d5c4e7d8695df85eba87effb4fe3be68f
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 bc9fa668d5831786baa7a434c9c013ec00be3e21a783f421459c121cfe5106e2
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 75390b932727099c4bf913c4a0f867016412437030d2540614eb429c78237c6c
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 fce7e2725cc06f77c087126ce60b839766fed8c017a01223111a76f4b1b660b2
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 be2c5009ffa74b911f696dd6edf86d81d64e2556f6f87a85b5ad529d0f164d9f
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 e6942df921149c69a092a2c35e7b285dab34374a08e93230b8b426d05f26d4d7
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 d1ff9fb7f0c7b79b16bd51c9432b6e77c85e0064025e3899a3062173865d4ece
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 0978d8d3773e6a20f2d14572cf41ad5349cd8828811fb39f98a8884d105ebdf8
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 608a816ec653915d409e0e1863e40c07698cf008fb50da8fa547723f153c08ae
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 b35536548b8b9c0502e5a79ce67086e5d64ff86d55a338227c9eda66966b2da3
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 7b5a5cc83feb956815290bfde579b400770db75449e9197229b22a953561deec
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 d6bf1e3962b84842dac7246ccd49c9d58e7aa9dc7fdb738e6d87e1dfb7a25a4b
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 f95d588a2f7c4c3aeee98e9388eca65aa5fa6df9e06a2b57b28f48682490de83
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 2796b56674519ed3b7249c3a7b4863ab21e62f7a329354d4bba8f17f605c1475
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 9c3abd05b11705eb48b7cd912fb3be6921b413ac5cdc9790a303901adbba4602
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 32d3b7408372995d07ff68045cc5c629c83774bf60f71ca44724dbfacb76eedf
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 bbc58a33ecbca14be7a1c1563c216ea2841b3f271b3013c691842dd0f423eeb3
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 838db25c324a7b8b84d28bef2b491c5917fd52d8315985e69c8af0cdb009470d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 a7a64f97bb2886ef6f97f41fc9784072cc8775b3763a5b85d8073b450cfbc026
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 ef799d623a69998e3ca742e3c0e0ff3b798c0e6716146a0b855771f4a4d935c2
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 a81ba995d649c0a58606f0d7a8f745efb6bc86b10c98dd9402cf6a93a1c5cef0
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 bbca505d84374e422e4df3bdbe70acd56589b92b962cae66524d1d1e2c784972
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 b53bc232352c786d6f2d445eae03eb23872fb56043d15261a3f1f0b062ace1f6
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 acdf0aa1904101914f25317f0fe20689006a479a70116d9f322a0d2556c1307d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 2faa25a33dbf7cb308aa20df18e6ac7da9bdde1213c5b30734ed9b86c129153b
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 5336f99ad709ef7b47374241946ee10ea21c884c6fda9be7b1e8cdd609b8f743
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 966813db5cd2f6e7f73e637b862e92f6943c3f4a5391e6f2e0d25b327cf036b7
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 873db116cf42d9039a237e2fef75fa09fd185f8c1cbf3643e9199eda38d7e918
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 2135f82f54043eb911244622bd125fe31c79c6333326af3e7f3bc94c8aeec2aa
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 4d1f3eb582d59542d027967b89ccdf087904c4df37954e193a17e32886d14772
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 d3ae3103e1de94052981ccc7b4110d4f1ced573c6fada859ccc790a283876572
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 9a97904fbe3222652fa4ec59e439d3b85981643e2ca853e2f08f5258a02ee894
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 a4cc8e3234df4c877479cc595d11b94b224919ec70933766e3884e7063c72a55
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 1c9c5743a9d41357b6ca6a53930463da665108417770b73d2f48ee3673ad3a46
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 37314802e473715fc470652d3c90465e78aacf8b3e5f222fd85214f9e9a7117d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 d8e3a21e98d4ab70214218743eae4f247c2ded1e28ca8a1bb7e15c8e23853ece
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 03555016296feac489836eae8108c88ce20abc47b248530925f89e900a776922
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 a329b3f139c8dbe78edd6f8d5df08fe312b205d10fd8d3ab615073739df23908
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 071ba73e75355d8fbc26963976106cac315baafe9f0186e9aad2cc0723a9b0af
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 5ecfa4305778dd6638eecea131c122e2ed64f267cc9a53c2cbcafb7e78280454
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 cd4984b003b5212a3ffaa95bc41d8cf827cb46e8714d6f052bc7e6853629f0d2
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 178a1849448e61505cfc765b50f69d8da021fed732d1c97cd272d66789245b5b
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 96ac004dd8578a0ece96bca113ced923d7e8064d56b999ada8d22088dd162095
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 82fc621f8f9275425e4b4202bc99460fd33117c9510d6b14a2f0229dbb47da9d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 c0b86d9949451f53cb314888dbd3b07371d82e494a6b57b45747fe69bcab6dfd
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 fca3d479b8390d69619f7e95d100010f1316c1a2264c562a57bb21182be3de63
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 d170bfd9c4bdce2f180cdceeeec2852cb12cea875f3b2968264355f3f9ffc55e
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 6d826092baa8513e2015d969d0d727f11e049ae42c8580dafc23486bf1fe1f31
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 f953c50d2736b74b8d61e40dfb504594ef6de2b258ac2f54d65881302dcd8024
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 85d14b9078b6b00905afc4defa4caf1f4d052245b0eac23c828c09c6bb50b81d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 4be3e32f9dc9ffb61756ffb0bb86ced743f4d5e2e2e6a64bac6b0c754e688bb1
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 86056082551d887cda84116dc33ee266109525087cf755a416102979c1020f95
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 ca1854b545e1b811459a79d60369a70338a7f601e6caabc31c049ca993f30ee6
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 bbd8b41a5ab72608ada9900f00e55ef6d3f679bacea2c50a976c1f6e57a1585d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 cdc76cc33392864fdb0a22c4188bf4cec41043b3d2acf6ec8e0be65dc9bc9de0
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 7419ad59fd95f4d4317dcab99d9e1b7b360f1904b5327c889fd71e60f667fb67
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 372296c161a4c548173706d72f69f32cdae6bed837963c8dab97cadb6d9d30af
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 2e616c2edaac031d4e4b9c3b170d4c86304953d69a19c70442cd8b1c2b1ec0ad
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 2e5c0773592bee0e3355925e77b948cac35c9e6034d85789bdad4ac9a684e067
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 405cb123e1b67be5a68f7e5ee80ee57e251e3feda0edad5ca3a44bf9644860c7
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 08d5608f27334f73ec953e706fee3f20f75826c71805a8f5eeb940ee404ef509
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 af2af1fa9b86138c7ad9283e69db1c2a3d0be8d91d178c0e92f495dd81648c60
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 c74aad8b401095f5ecb1ebcb588cd5379734a335e0146aa65581725136434dd7
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 977e584c4e5e22a30a06278a676ad2b2d8ae16f92f2f868124941c9b839eda27
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 d6acbe711560072fd3c86e16afa1588a41f71ca5d5d5e387ffba94ba8cd04829
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 a58b3916e3a81968475b2a9db804dfa6a405e6df7a8180eb60b82b6ba799660a
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 1f20a1df8dccd17c9fe8ea42c12d5413b692575a25fa9da54cf55aca8287f4cd
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 26192623118ec04af21f817b49631c36800bc93b802c7dc71156d197c6c15cd2
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 7239eae3f1bcd16c623f9a87d918f9e71c7c8c98852c3a8ed8bb5f63b6337846
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 e7c645e61ed3e72a21f10d1162e781a4f49567728eeea9fe423705325989ce4d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 bda106b06e86bed8f98a334233c18757fd963ea031b748cac9f7e848c1cbb33d
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 fc58d060a01ca45ebf76f5306f5324b829c288c470aa42a80df9f44e9fb50ea3
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 a12bc83fee4bf1335fdb87ced9d598aec0d0ca9df79c73db1afc60407b64dbf0
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 e7cfd4da25fc1dae5f1fe81282c2b91c2b3003af46168730bafce0a754934686
                        • MD5 SHA1 SHA512
                        Submit Download

                        ZOIAYIEA.inf
                        • Path C:\ProgramData\XucsMIcY\ZOIAYIEA.inf
                        • Size 4B
                        • SHA256 7dec84ace32fc9c982651b8309b61c79ff2f40d2c17e98b4156c338738177d47
                        • MD5 SHA1 SHA512
                        Submit Download

                        makE.txt
                        • Path C:\ProgramData\makE.txt
                        • Size 9KB
                        • SHA256 cdba811bb5ef7f92177cccf22e3f2ce57adc052d1371d7eb49a60c20815e0964
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        caIgIsko.exe
                        • Path C:\ProgramData\oUYgIsQo\caIgIsko.exe
                        • Size 1.6MB
                        • SHA256 617d8b6f840c836ca978edfd273acf231fcd9926527d5b85166bdecce096dc34
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                        • Path C:\Users\Admin\AppData\Local\Temp\2026-07-30_a816aee3bb96a91ee8baa62c68bbbb8a_elex_virlock
                        • Size 5KB
                        • SHA256 98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AUAW.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\AUAW.exe
                        • Size 1.6MB
                        • SHA256 da33cc04d5a46c30e09e14e51d4ae95b5552698a62852fc796eaa06e29692377
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AYsA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\AYsA.exe
                        • Size 1.8MB
                        • SHA256 f36550091cf185382d7cb34b76a0744ef45948afdf2d7023d9a5426fa7921704
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AssS.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\AssS.exe
                        • Size 1.7MB
                        • SHA256 5ba798d15b0adf105b682e7562aa22a49a5c7fd40ebd2ba1b6d936011c49adae
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AwkG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\AwkG.exe
                        • Size 2.0MB
                        • SHA256 a2a2ea7ca0c6cd45ff346ae84a495a070dd4e4547fe50b9ad134f968f6c3d64d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AwoW.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\AwoW.exe
                        • Size 1.6MB
                        • SHA256 8ecf29fda9fca9fd376e41471a765130950e1f9716dcbc605587ff88c606caf9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CEkU.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CEkU.exe
                        • Size 2.1MB
                        • SHA256 ebfeddf6d749b227fd440760c858b7380c168b8b101c545da6845261582a81cc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CIEw.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CIEw.exe
                        • Size 2.0MB
                        • SHA256 c551b28559c0e4cdc6fd94b79fc99ec1202556c48e2d47bbd29c78a11f8c842e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CMIm.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CMIm.exe
                        • Size 1.9MB
                        • SHA256 5faf05464f3e2e5a13ba092dfbbbac8c534d055a862682d4d70b906793a666af
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CYMy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CYMy.exe
                        • Size 1.8MB
                        • SHA256 e7dbd445f0225d9c5b4a8f7dcd31463e21c900afa913158f22c81da45a6732b1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CcAw.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\CcAw.ico
                        • Size 4KB
                        • SHA256 4b700d3ddd9647f8b7da5a6d85d969ac492102d6c1053b1977d7bca36c2a324b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CcoA.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\CcoA.ico
                        • Size 4KB
                        • SHA256 955ad377b15d14e80d8eb194375f26e0e9e339b1cfc1e4047e16ae0e0f90fe24
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CgYA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CgYA.exe
                        • Size 2.2MB
                        • SHA256 14e26d3e9c47301fd0ee78c95edb3cb02859f9e4410ddcba3bda9d82deadf6e9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        CkkW.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\CkkW.exe
                        • Size 2.7MB
                        • SHA256 6b587d32033ec45ed7b39426f8d66533c61978a887048fcd78f002ce4242f9bb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        EMMc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\EMMc.exe
                        • Size 1.9MB
                        • SHA256 81933d29b5e2f367929756de5c0b68c829ed1d93f31228746de897bd8d005d89
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        EMQo.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\EMQo.exe
                        • Size 2.2MB
                        • SHA256 d43b194ee3385ad82b65448ffc12db88ddddd7eb79426a27467acc904e788476
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        EMUk.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\EMUk.exe
                        • Size 2.8MB
                        • SHA256 453339513093fd8abec07e8d9cd5d958503f860d748b052408ed8120046154c0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        EQkU.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\EQkU.exe
                        • Size 1.6MB
                        • SHA256 3cd1b05879c1113a2ca634a7a0c894ef58d3552fdd8bcd7aff7c8fb13d9541fe
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Eoci.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\Eoci.exe
                        • Size 1.7MB
                        • SHA256 335bcc14b694094c1249568b050200fe5b8526f459f592d9d36b44991daf6ded
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Eoos.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\Eoos.exe
                        • Size 1.9MB
                        • SHA256 682c823f0cbd1d3927107e506f03d8b807fe726af22a28d5d55c055137133fc7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        GAIe.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\GAIe.exe
                        • Size 1.9MB
                        • SHA256 7d832f783dc6404c0f742d1bd09c16841a604292fe43610ad8528e670d947254
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        GGsIoQAs.bat
                        • Path C:\Users\Admin\AppData\Local\Temp\GGsIoQAs.bat
                        • Size 112B
                        • SHA256 ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        GkoQ.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\GkoQ.exe
                        • Size 1.6MB
                        • SHA256 12080c76c4954ecda12072e51eaf976c6c948018efd6b1dee0579646ae50dae4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IAMY.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\IAMY.ico
                        • Size 4KB
                        • SHA256 e4c00332694cb4a7fdbc6dc19cd1eef271dff84d8a0a601e70f48e597351cf82
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IAgK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IAgK.exe
                        • Size 1.6MB
                        • SHA256 a2120cedb599a242f8264bcd5740f0844c407b5d1689c3407c9c87085518af4c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IEYw.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IEYw.exe
                        • Size 2.0MB
                        • SHA256 2f15579696a7532831506f5966dd448619e96d232c7578e6cb79d3b2a11dc9ef
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IIYy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IIYy.exe
                        • Size 1.7MB
                        • SHA256 3b6c4523d01d32b3331bfab2f9b0a3e92a5739b07ec6186cf1aee2346e8979fe
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IQYK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IQYK.exe
                        • Size 1.6MB
                        • SHA256 47aab1a4b68106b8fd892def7cd1d5d32ec110a4a0ab21da6b26f6506c1669e7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IgEC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IgEC.exe
                        • Size 1.8MB
                        • SHA256 7efc649ecc66a9fd27c9ad11b5f3f0842b6c37ea1b3e8fecc4474bf4624d4ead
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IgIE.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IgIE.exe
                        • Size 1.9MB
                        • SHA256 85d35a47374bc7c1d78a3a51f25873d3cef9ec5f996867db609371a11171f4c9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IkMy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\IkMy.exe
                        • Size 2.2MB
                        • SHA256 099a424583eb5628ca5660760697fbb7a0c8e701680c2711e785caeb7d882d51
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        KcAM.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\KcAM.exe
                        • Size 1.9MB
                        • SHA256 24f49ebc47df44da4398cf49eea93c39c1a465559d7e027f8e38df269a65f6bd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        KcAM.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\KcAM.exe
                        • Size 1.9MB
                        • SHA256 55798e733fa068be13357a626913de2860b8c1516f7186f53b281f71f8b20988
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        KecE.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\KecE.ico
                        • Size 4KB
                        • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        KggU.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\KggU.ico
                        • Size 4KB
                        • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Kksy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\Kksy.exe
                        • Size 1.6MB
                        • SHA256 1180e33221b2c0a36bdc694de6d01e4976c8acbbd0c9f011067e84e3e808611c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MMQe.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\MMQe.exe
                        • Size 2.0MB
                        • SHA256 354834f8619101a6841522111503d46fbca592f380193791e628cbd05da099b5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MQUC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\MQUC.exe
                        • Size 1.6MB
                        • SHA256 0ce50bdd935fce29a18614789fd4411e642d35ada76c6f9b93b82f46f826454b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MUUQ.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\MUUQ.exe
                        • Size 1.6MB
                        • SHA256 d4c0c1ac8a5c443beb02a5b76c313c561b10e5d710d9dfed37b6c2d6884f33be
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MUcE.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\MUcE.exe
                        • Size 2.2MB
                        • SHA256 e5c7a04b62c47ad466c7ab78af5d45dc1188dc38b7719f1135a322c54ecc48ae
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MYUK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\MYUK.exe
                        • Size 1.6MB
                        • SHA256 f93d1d6aca865f5ef970abeb221b26a7938557265e7c5d148f6dc5396dab8f1a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        McEi.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\McEi.exe
                        • Size 1.6MB
                        • SHA256 ddc1a0ed39408139515f583bd7631e690eefe1b5fbd5732e5a3b513a2db9ce51
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        McYK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\McYK.exe
                        • Size 1.6MB
                        • SHA256 83c0b507a19f9c5215d31b68fbeec204c854d9d8dc063b2329cd3092ee38b394
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Mccc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\Mccc.exe
                        • Size 2.1MB
                        • SHA256 c7deb4d1f327249a152c7c128ba8bac6c009037306fca65d84729caa5d887a63
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Mcke.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\Mcke.exe
                        • Size 1.6MB
                        • SHA256 623ba03090d97719a8fb0fa8276475baa3f0b860d5f9864d3601db155dab1385
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        OMwy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\OMwy.exe
                        • Size 1.7MB
                        • SHA256 e4c7cfa7181e4b7da201e71b73d96d4f3bf38aca72d2307608b29dae50ab2a72
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        OaMI.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\OaMI.ico
                        • Size 4KB
                        • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        OsoM.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\OsoM.exe
                        • Size 1.8MB
                        • SHA256 b711dffcd3988435d352b8140c32219f670d57b44581d98487b8432e0dd97d7e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QAoo.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\QAoo.exe
                        • Size 1.7MB
                        • SHA256 1cb41c7691e31e25f055b2a2ad606e7e3a98cc99f906c231b18017ca456554b0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QAsi.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\QAsi.exe
                        • Size 2.1MB
                        • SHA256 b9c84593e822a7e09864cef623d6cf89b54c9ff916672e52f2a7ddde181fbb9a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QIEC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\QIEC.exe
                        • Size 2.0MB
                        • SHA256 4228c7044c965e47abe0724c333dcc0e3038c4613e54d9ed9df2261a190a4fb4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QIwm.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\QIwm.exe
                        • Size 2.3MB
                        • SHA256 530c4daa43ef2ad2acf65abc966cf7f35720af7712156dbf75b1dcee62c5e729
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QQIw.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\QQIw.exe
                        • Size 1.6MB
                        • SHA256 abf2a6907210ec2207d3988823bddf7066d798a37cdf0e9d49f361cb660fd418
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QcQc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\QcQc.exe
                        • Size 2.2MB
                        • SHA256 c7b903c1c2395f9c23e2d2c5839d2648051abf4ed30c58a79d1907f5ebaa1460
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        QqwI.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\QqwI.ico
                        • Size 4KB
                        • SHA256 114dae4c54ca426f78e50998727dac92942261d71ca5b2dbaf413794dcf8ad82
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Qwkw.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\Qwkw.exe
                        • Size 1.8MB
                        • SHA256 a832f1ee488ea719f21e903b956570d7a1295195ee51baf972dbffa8684c9b9e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SAoM.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SAoM.exe
                        • Size 1.6MB
                        • SHA256 1e6f097d1f27f449fa30f46849cacfbe07a77283b7e525df82dbf19ff970fe28
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SQcs.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SQcs.exe
                        • Size 2.6MB
                        • SHA256 4a18933cce3f759f453de796f8a635eba822f6181bb258bfa50537b96b69dc4c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SYoI.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\SYoI.ico
                        • Size 4KB
                        • SHA256 0e140fda863f8fb77d504391b920972bfc33da1bf087ebc7728bc700d402d0f3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Sskm.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\Sskm.exe
                        • Size 1.8MB
                        • SHA256 c575973481df84876ec445ba865dc7295e963c8dad674675274f91d9c03722d5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SsoQ.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SsoQ.exe
                        • Size 2.2MB
                        • SHA256 f727bd86da3b0a7a8ab45aec0693b6ff9d892692fccbb3ce67243fe1675d4dbf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SwAU.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\SwAU.exe
                        • Size 1.6MB
                        • SHA256 b78378ffa217a860ba98be25bd7c06e31c787dc19b6d4018ee37e739b1a1e8f0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        UYse.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\UYse.exe
                        • Size 1.6MB
                        • SHA256 35678d3fefe5a647580004f9688667897fcb2634b0e48e0b5df4d4fc405dea2e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        UkEM.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\UkEM.exe
                        • Size 1.7MB
                        • SHA256 cd1514eace7b308d98f1d947c02eba2bb4ac405bacf12ec205d80a6c894184c7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WQUI.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\WQUI.exe
                        • Size 1.8MB
                        • SHA256 f9797250259376709f0b0995fa876577974f59473a18e0ad87348333ffad0fea
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WUQY.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\WUQY.exe
                        • Size 1.6MB
                        • SHA256 417848f523393004b1e775bb96c71d007a4a5613c145e4824ef6ef01b42b4d8a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WYso.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\WYso.exe
                        • Size 3.1MB
                        • SHA256 58256d749416f1cb998787635e2f595305a561985de46b7783d39960ef1f38f0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WgQO.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\WgQO.exe
                        • Size 1.6MB
                        • SHA256 7ef667bc154df2a546f7207dcbc323e107aa299dc5bb6deb99c38512c70bff2e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        WsoQ.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\WsoQ.exe
                        • Size 1.7MB
                        • SHA256 8ff11188ffe84bf16cae06de7ac85d1613e410a6ed0ee0da8731db2e7f2d608f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        YUwA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\YUwA.exe
                        • Size 1.6MB
                        • SHA256 acf182bed1a84a7e01d3cd3da5f7957479bdad08fe704e919854fd6633bcf876
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        YkoA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\YkoA.exe
                        • Size 2.1MB
                        • SHA256 5beec3c27b0dad24a1e629c980fc8772e902ab29174e141ef52e618413fb694f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        aIck.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\aIck.exe
                        • Size 2.1MB
                        • SHA256 f8d3209f068b7be72e1d0c30b9e5b691276c39fa8a8b7a6e8f69c3a93baf804a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        aKco.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\aKco.ico
                        • Size 4KB
                        • SHA256 e5798e3d8c1af62d997a27bc2fb7333639a4f20e9753cf7a5b0639cd93f96448
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        aSEM.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\aSEM.ico
                        • Size 4KB
                        • SHA256 bc4ed7d844af9da0a5d2fe12e8db07fbfdf6e0ecd557223b292bd0e9cb6a64a1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        aYYm.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\aYYm.exe
                        • Size 1.9MB
                        • SHA256 5686178ffae155d56d0a8b5a6d74643b0d48fc9159b3f50c4865fc6186405694
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        agcs.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\agcs.exe
                        • Size 2.2MB
                        • SHA256 663c1f840b21f068f5dd21b015935801a3b9b09c34b017d0e9ef6ff2c1f02424
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        aoIi.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\aoIi.exe
                        • Size 1.6MB
                        • SHA256 97a1a4222c2ce4421e7015366c8a05ee26d1676aebf1ea04555754a9ff9dc94d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cAAS.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cAAS.exe
                        • Size 1.7MB
                        • SHA256 c4fb4cefd8f6430b1a39d4469b34f08a8e4614a1d4d2b6125fef422b62d2bb1c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cAwu.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cAwu.exe
                        • Size 2.9MB
                        • SHA256 beb6f6652d5030bde732528b9c6d2897b09bbde407c4b7aad628be905ec5d4ef
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cQMu.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cQMu.exe
                        • Size 2.5MB
                        • SHA256 f2a93c6d1d8d4b2d5abe3fea07f6cecc7f3598020fe849c85ea96fbf8d241cc2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cQUC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cQUC.exe
                        • Size 1.8MB
                        • SHA256 6a1d2fc120df42a261990ec70e6c57f4f4efe49a09909e04eb2fd87bdf5207db
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cQsc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cQsc.exe
                        • Size 1.6MB
                        • SHA256 2a8778b1b58500db690e84cd05b5ce849528241cec3fd3865c33127a0eeafe62
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cUga.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cUga.exe
                        • Size 1.9MB
                        • SHA256 839ea50b209c64c90243462b34d6f687afbc1d399f6273b2dff28c5518a4a5ee
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cYcQ.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cYcQ.exe
                        • Size 1.8MB
                        • SHA256 e66e765af26be3f02a562caae26e2d44e6a903acc1e67a41db880993f6eaa894
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ccoK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ccoK.exe
                        • Size 1.6MB
                        • SHA256 9029e5faeb44a6982d57fb0232b02fd50aaf74a3b031fb9c6897872cbc8f6c0f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        coYk.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\coYk.exe
                        • Size 1.7MB
                        • SHA256 0fc9a5045e4c89850127510cee1003da0de017b720dd85a2ec87a9b58b0777c0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cwEO.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\cwEO.exe
                        • Size 2.0MB
                        • SHA256 3397b3e9abe9eb66651013ead5c2a997ef196b08097411f032e02ca28fdc0b17
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eEoU.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\eEoU.exe
                        • Size 1.6MB
                        • SHA256 dd6d457f53235ffe0ef24e77088bb32f5f29dc5605503eeafaff5c64fbc38561
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eMAa.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\eMAa.exe
                        • Size 1.9MB
                        • SHA256 2684be6d0684941aa6df3870434d3baf581556cc778fbbaa075ff17e4b00f0c3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eUIu.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\eUIu.exe
                        • Size 2.4MB
                        • SHA256 294de7e3c4c99049c56b6552590f88ee9e5e9d31038f28ec58e0344ab1e401b1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ecoS.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ecoS.exe
                        • Size 1.6MB
                        • SHA256 57272051146421e183c5847a9c98408e4a986b955a4ba77f3488f585f4d96028
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eosq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\eosq.exe
                        • Size 1.6MB
                        • SHA256 779574907662a27997795ed6b6f1fd17408d054c7dba6581db92ed310128d799
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ewos.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ewos.exe
                        • Size 1.6MB
                        • SHA256 eea7937d167e709a00f31f0641412940cb3b2abebaa1a104037cf0786abc9055
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        file.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\file.vbs
                        • Size 19B
                        • SHA256 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
                        • MD5 SHA1 SHA512
                        Submit Download

                        gIUq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gIUq.exe
                        • Size 2.0MB
                        • SHA256 04aee328e0b69bbb8a1de3786cdd3a752a364856ac432b1d9a74ce82ffe1a1ef
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gQse.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gQse.exe
                        • Size 1.6MB
                        • SHA256 9a0110c4680187d996d07cc8602eb04e80c86136a5f2eddca0b6e8d0e984d606
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gsAy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gsAy.exe
                        • Size 2.5MB
                        • SHA256 dd26cff21fc0fa7d3034d344cc838f61d84d93922a1a67021d950107cf4ffcd7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        iMUq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\iMUq.exe
                        • Size 2.2MB
                        • SHA256 a537737396d8fd0511208c5bf80210774542dade67ca97d1037b0054b8eb9d96
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        iSoc.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\iSoc.ico
                        • Size 4KB
                        • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        igkW.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\igkW.exe
                        • Size 1.8MB
                        • SHA256 15ce9f43e8450fd176627569eb5af48fa3f2ec29af1cee35db15224bf45fccc0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ikAY.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ikAY.exe
                        • Size 1.6MB
                        • SHA256 d17574eed5441df15737121136ac422061243c3d473a18371713b53583a6b838
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ioUS.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ioUS.exe
                        • Size 1.7MB
                        • SHA256 72307fa6b671554a1acf6ffea65c8a80beceaee754bd86f22519036e2979fdea
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        iwwe.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\iwwe.exe
                        • Size 1.6MB
                        • SHA256 93195f988a0671b165b4e39a074d313da6c2e7e347b4f65fde5d1a43b6b8582d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kAEQ.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\kAEQ.exe
                        • Size 1.6MB
                        • SHA256 ef4f6ca2619849eb06f2e226af7893004a1e7c9c9835b03b3aedb4cfb3688a71
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kIAQ.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\kIAQ.exe
                        • Size 2.0MB
                        • SHA256 d2a3dc72ab39bfa7e10b0878a44d81afb5ac7fd340c6cdb9f0bfe9caed71a44d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kMsW.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\kMsW.exe
                        • Size 1.8MB
                        • SHA256 a0ec02ac9e07f45c7580663715db641bdfb36f9f595c5ce09d039a39bb2c120c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kkoy.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\kkoy.exe
                        • Size 1.6MB
                        • SHA256 df09ae94e2b552b2c47ff81f1e0851dba4df084d100cd1f51a9a09d0716bdc1b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        koQq.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\koQq.exe
                        • Size 1.9MB
                        • SHA256 5e679fc16a2b3a8d437598ff02166871e34e522cf73295d2291b1ab535f91927
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mQsM.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\mQsM.exe
                        • Size 1.6MB
                        • SHA256 e419a723ff264e59d057cec3fec10408671cddc705a88bc716a956792287dca2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mUIA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\mUIA.exe
                        • Size 1.7MB
                        • SHA256 9b99e3c152efc27cd49d10efc0eae098cebd72c059795cf3710684b61d0d4c27
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mUMK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\mUMK.exe
                        • Size 2.2MB
                        • SHA256 48a4e88c8df62f9ee13222215533f00e03241ddddd2f2b5571c6810d6f918982
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mUUe.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\mUUe.exe
                        • Size 2.1MB
                        • SHA256 f73247c0828c3453740fe0dc0bae6786b1c5a98399b1b486126e1ffc3b5e88d2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mYUm.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\mYUm.exe
                        • Size 2.9MB
                        • SHA256 3bff3e5b4b6b5ca87caca44629b7e1eb19847a7e49dcede7cc460a4f9ea9c003
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        mcgc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\mcgc.exe
                        • Size 1.6MB
                        • SHA256 34bed49c379062b5756d4a130d37c01ed1da070498a5c325be904d1caf564f23
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        oEEU.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\oEEU.exe
                        • Size 1.6MB
                        • SHA256 2318d0576467c4878de696527c994c3a80b7af488f63182fd6229ec06a81f77c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        oEQm.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\oEQm.exe
                        • Size 1.8MB
                        • SHA256 3154b171390182d9fcfc1f8541bff0a909f27057c99f4e1b667da18b135778ba
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        oIwM.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\oIwM.exe
                        • Size 2.3MB
                        • SHA256 1f47392746e4c8c7e50f105060f1366243c037fa29e5ef66f878fe2ffbff1cca
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        oQEs.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\oQEs.ico
                        • Size 4KB
                        • SHA256 119061f905398193977c21e4b6787c9c42b3c7d8eb05b8d2ee33394ac5873619
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        osoY.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\osoY.exe
                        • Size 1.9MB
                        • SHA256 9139a2171cfe9bd6f396b8b805b7245b108c50c8e927b209944d5fcc50fc2627
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        owMu.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\owMu.exe
                        • Size 1.8MB
                        • SHA256 a5d76e299055ec1f2080abfe4e4189c0deef573cc321b4b474c11bbb7df7bf24
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qMMW.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\qMMW.exe
                        • Size 2.0MB
                        • SHA256 c11657f85849913402042d061f7ea98a56ba0d36727279ca9a00829db33b9c99
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qQIO.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\qQIO.exe
                        • Size 1.8MB
                        • SHA256 c399c941ebddc9a7e4cb04201fd97574620c1e56b86759ba91bea2f2eb810cd2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qkcY.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\qkcY.exe
                        • Size 1.6MB
                        • SHA256 de2bfe39ed84a99bcc4b1ec81c3a00182c5656815ad7cf3bc40fe9466434dee2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sIks.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\sIks.exe
                        • Size 1.8MB
                        • SHA256 83fc9b0c5841fc9d0ec07facb2cc7a2f5266c9aba1334513d624e4ab3bbd1af5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sMkI.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\sMkI.exe
                        • Size 2.0MB
                        • SHA256 14c0593a45c6df2bf2a2dd25d453ec9d3d9e6a5f1d8679b99a993ed2e947e518
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sUwa.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\sUwa.exe
                        • Size 1.9MB
                        • SHA256 dc882583b7851b3962e7fff7b6a45e31a11e32a5e2a76b06b42e6d31d39302f3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        scwA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\scwA.exe
                        • Size 1.8MB
                        • SHA256 fe0d74f770a323c39572f516a1dea8bbaedc51d4e9b2bd1b40687c77c9e35441
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sisU.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\sisU.ico
                        • Size 4KB
                        • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sosu.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\sosu.exe
                        • Size 1.9MB
                        • SHA256 95a79219c62cecfc9aaea4e08c965bfe6d4a474c616425881fad3e32071da24b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ssQw.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\ssQw.ico
                        • Size 4KB
                        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        swUw.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\swUw.exe
                        • Size 2.0MB
                        • SHA256 10410e08a308ea9543cf9ee6b973c3c7346f6e5a99d89115cc8be7584046e39e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        uEEa.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\uEEa.exe
                        • Size 3.0MB
                        • SHA256 885800ef2c0423ac552c545fbafaf4bac1728744d678fa942adde30cd86d9851
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        uMEG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\uMEG.exe
                        • Size 1.6MB
                        • SHA256 28a40a6e23f62f60398c4d6ccd3a356f8015ddd41bff2178fedde2cd7e72dde0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        uMUC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\uMUC.exe
                        • Size 1.6MB
                        • SHA256 246b1c4ae6f830e284e31fe0be6643923bb412ebe0c0f5a7dd2472b7655fd46f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        uYwK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\uYwK.exe
                        • Size 1.8MB
                        • SHA256 7315998e4f42b5767652e4eb7c69a5ec5148bf4373dba8b57f3d418fcb10c329
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ukQC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ukQC.exe
                        • Size 1.9MB
                        • SHA256 11c49a471b41e9e4fb6af863843bc08e69e1063018a7cd8c9987853bcd5ff6d8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        uoYG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\uoYG.exe
                        • Size 1.8MB
                        • SHA256 44a98fa561e51457ec1408884f5d617c3707c8ce5b1d791d207370db93d00329
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        usIk.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\usIk.ico
                        • Size 4KB
                        • SHA256 e1131246c60ad423586203bb8b9287e365051101ddbf532132bd47ef03ab86c8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        usMw.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\usMw.exe
                        • Size 1.7MB
                        • SHA256 53279704d9c62b5274327421a673bd01f7c145214452b5cacf6cae539df10c5b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        uska.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\uska.exe
                        • Size 1.9MB
                        • SHA256 3bb1006697d4129e36db2420d2e05ba4a6bd9bbea6298488be90e736113c6eb8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        uwQg.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\uwQg.exe
                        • Size 1.8MB
                        • SHA256 365eb14b2aed3d9a6d074e272582d4d1b367c7e31825e015f67e5fa11baf844b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        uwws.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\uwws.ico
                        • Size 4KB
                        • SHA256 f8e8be11d1062a945187b65fc5e5b1500bce03cbdbf6f4af9404b649aacc2aa3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wEAA.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wEAA.exe
                        • Size 2.4MB
                        • SHA256 5f0ff4da87b08e2f6ea3508deb9d85ac12cc4f1d901adce9b9eac4a391a60d22
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wUoM.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wUoM.exe
                        • Size 1.6MB
                        • SHA256 c4ebd8fe3f3920a713bbe5eaf27fa6c69ed222701becf2abcf5639c48aca670d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wcIe.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wcIe.exe
                        • Size 1.7MB
                        • SHA256 bcba8bfc76ea88da2d87c0d0fade6e0e1fdbad4cba43b6059e1d6742bd5fc236
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wcMo.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wcMo.exe
                        • Size 2.9MB
                        • SHA256 fb7b19e6354a5f7f097125e9a02a307df8e5e0f859f3483bc579153fc9591cfc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wkcK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\wkcK.exe
                        • Size 1.6MB
                        • SHA256 d6f742ae0fba91909baf324e77cb2c69f3d3330948176ba881a4d3ab93b4e019
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        yAkK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\yAkK.exe
                        • Size 1.7MB
                        • SHA256 46aeb50a5716b67566694075d0d822b8bf647f7f0f56bcddf1443e126efd86c2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        yAoG.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\yAoG.exe
                        • Size 1.8MB
                        • SHA256 41802fa240841d6d5875ea5c54173861e4fe4cccadbc8b14de95bbec80aaf95a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        yEEI.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\yEEI.exe
                        • Size 1.8MB
                        • SHA256 afe9a642d66ec1d4830a800ea6cd8482bce685550c5b19f962e7c795800c6b5b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        yEsw.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\yEsw.exe
                        • Size 1.9MB
                        • SHA256 70b087649caa7f988300ff1441c801aace4813c8594aa85b1688d976e1bfce04
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        yMgC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\yMgC.exe
                        • Size 1.6MB
                        • SHA256 27ae0482689057c281021d1d8edd7ed86e09ed04f48300fb44985ff6f37887d3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        yUwi.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\yUwi.exe
                        • Size 1.6MB
                        • SHA256 a6dcb0942552ce6f4bff0beee43a10cd20806f905c136f9a31be877e62364582
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ycAe.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ycAe.exe
                        • Size 2.0MB
                        • SHA256 7162bff9190ff964b9a6106136eab806dd39c4eb3ca492cd008fec88b470a172
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ygEK.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ygEK.exe
                        • Size 2.2MB
                        • SHA256 aa15abb3e5a7e07c36649c06a49cdea6bd90a84292ddd525611db0f587bf95a9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ysAc.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ysAc.exe
                        • Size 1.9MB
                        • SHA256 6cad3c8413676e6075e0413d1f16195db0e105cf0bba2eb48cc2e616ebd160dc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ysYg.ico
                        • Path C:\Users\Admin\AppData\Local\Temp\ysYg.ico
                        • Size 4KB
                        • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        NMYYQwkY.exe
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.exe
                        • Size 1.6MB
                        • SHA256 9bca2444cb529588cb6987f2fa893b93adc7547d7f43b533c4d2eb08487d00c5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 4be19be83429bb0f90e68006bf95be2f872618abee87b4642a5a6d6fd454fcf8
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 5c9f9cc1dcde3b46e06cd6f26a853b20897885854e66a1a0104798a3ed137bb3
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 e35cd9bf9cf1b0e0ef842bcfada2a33d25dbdf10becf2ddd6224f7e830e24c75
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 0a39236e2183d700d9e5fccf34943f83da7556d1e3c084da9e319fb29c05f35a
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 51ab7fc35d4310266a01fca2e7a29753444a27882a71ddd215c96420367b592f
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 3caec3c8e302d6c29fb6984dca4acb065aad5344f28f6057a78312a5d1f4b270
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 36e10a38351e3219976ef7a78884ca9cd28fa7cd422c45d936271ffa8bff8c40
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 8b7523304af67df3616447cbb064adbe022a23a51b7f80279363f252cea97155
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 2bb5ab8bcac4ca4e58158f2675fa37d4119dfce2d2c46cdbf8f59b76fe525272
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 8270b0bb0c41623a6ec1a1cf565ade824e1f181e25150c819fe1f59653dffaf3
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 c1d321b17bf43140b6e5b80289399b2152524843a23adff68f5e4cd632b24d4a
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 3078edf823d653d70d09b7c35f994b44711602c5db3478cf56d47638fb87f85a
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 26b97cf0c06f581b890abd1ee4ac5c8b664677d716911131465b928e1ebb8cbd
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 0da22d94cf2977aa3427a98388f10953d7ebe983b5de325508272929e018af86
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 a70ecc1bc7fe5a46da4204f01f89e2ddd9c16d97328d3248d5e028df12d8bc8e
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 261b5f82a48cee47731a498f2e005c26427c53b0a923e4df683da9fec4bfa1f2
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 94d56189220ea0613cd832b6a839ab1c16c17c68de9a7695352606ce30b12896
                        • MD5 SHA1 SHA512
                        Submit Download

                        NMYYQwkY.inf
                        • Path C:\Users\Admin\qwgcwsgs\NMYYQwkY.inf
                        • Size 4B
                        • SHA256 f3d7da47f2946b7c772cbcf4436858b75e337cf746ff974ca2e707e14c9be856
                        • MD5 SHA1 SHA512
                        Submit Download

                        memory/860-303-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/860-312-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/1136-112-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/1260-2153-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/1784-2130-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/1784-1914-0x0000000000B80000-0x0000000000BA0000-memory.dmp
                        Download

                        memory/1784-7-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/1784-321-0x0000000000B80000-0x0000000000BA0000-memory.dmp
                        Download

                        memory/2064-82-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/2488-2136-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/2488-16-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/2952-227-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/3348-2288-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/3532-216-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/3708-96-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/3732-258-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/4844-238-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/4900-2148-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/5092-249-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/5376-199-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/5392-270-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/5672-125-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/5676-68-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/5976-171-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/5976-157-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/6016-292-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/6088-280-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/6172-139-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/6360-301-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/6500-155-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/6560-20-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/6560-2142-0x0000000000400000-0x0000000000590000-memory.dmp
                        Download

                        memory/6844-185-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/7040-35-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/7040-36-0x00000000021F0000-0x0000000002210000-memory.dmp
                        Download

                        memory/7040-0-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download

                        memory/7040-3-0x00000000021F0000-0x0000000002210000-memory.dmp
                        Download

                        memory/7120-51-0x0000000000400000-0x0000000000592000-memory.dmp
                        Download